mirror of
https://github.com/tailscale/tailscale.git
synced 2026-07-15 10:03:09 -04:00
b6e17df646
Tailscaled had no way to seed device-scope syspolicy settings short of environment variables or a custom store wired up out of tree. Add a --syspolicy-file flag whose default points at a well-known JSON file that, when present, is parsed as a map[string]any and registered as a device-scope policy source. The default path is /etc/tailscale/syspolicy.json on every non-Windows platform (Linux, the BSDs, illumos/Solaris, and tailscaled-without-the-GUI on macOS) and %ProgramData%\Tailscale\syspolicy.json on Windows. The flag lets users running tailscaled by hand (development, custom installs) point it at an alternate file, and "" disables the load entirely. JSON values map to setting types as expected: strings to StringValue/PreferenceOptionValue/VisibilityValue/DurationValue (e.g. "24h" parsed by time.ParseDuration), booleans to BooleanValue, numbers to IntegerValue, and string arrays to StringListValue. The file is validated against the registered setting definitions at load time so unknown keys and value/type mismatches fail startup loudly rather than producing surprising defaults at first read. When HuJSON support is linked into the build (default; opt out with ts_omit_hujsonconf), the file may use HuJSON (comments, trailing commas). With ts_omit_hujsonconf it must be pure standard JSON. This mirrors the pattern used by ipn/conffile. On Windows the JSON file and the existing HKLM registry store both register at DeviceScope. rsop merges later-registered same-scope sources over earlier ones, so per-key values in the file override the registry while keys absent from the file fall back to the registry. The loader is registered via a feature.Hook from a file gated by !ts_omit_syspolicy, and called from main after flag parsing. tsnet still does not depend on the root syspolicy package, so embedders don't pick this up implicitly. Fixes #20305 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Change-Id: Ie6326461c14efb226979ac162998a9c6373ce493
55 lines
1.7 KiB
Go
55 lines
1.7 KiB
Go
// Copyright (c) Tailscale Inc & contributors
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
//go:build !ts_omit_syspolicy
|
|
|
|
package main
|
|
|
|
import (
|
|
"flag"
|
|
"log"
|
|
"os"
|
|
"path/filepath"
|
|
"runtime"
|
|
|
|
"tailscale.com/util/syspolicy"
|
|
)
|
|
|
|
// syspolicyFile is the path to a JSON syspolicy file, set via the
|
|
// --syspolicy-file flag. An empty value disables file-based syspolicy.
|
|
var syspolicyFile string
|
|
|
|
// defaultSyspolicyFile returns the platform-specific default path for the
|
|
// --syspolicy-file flag. On Windows it sits next to the rest of Tailscale's
|
|
// machine state under %ProgramData%\Tailscale. On every other platform
|
|
// (Linux, the BSDs, illumos/Solaris, and tailscaled-without-the-GUI on
|
|
// macOS) it uses /etc/tailscale, which is where admin-provided
|
|
// configuration is conventionally placed.
|
|
//
|
|
// On Windows, when the file exists, its values take precedence over the
|
|
// HKLM registry-based platform store on a per-key basis (with the registry
|
|
// providing fallback values for keys the file does not set), because rsop
|
|
// merges later-registered same-scope sources over earlier ones.
|
|
func defaultSyspolicyFile() string {
|
|
if runtime.GOOS == "windows" {
|
|
if pd := os.Getenv("ProgramData"); pd != "" {
|
|
return filepath.Join(pd, "Tailscale", "syspolicy.json")
|
|
}
|
|
return ""
|
|
}
|
|
return "/etc/tailscale/syspolicy.json"
|
|
}
|
|
|
|
func init() {
|
|
flag.StringVar(&syspolicyFile, "syspolicy-file", defaultSyspolicyFile(),
|
|
"path to a JSON syspolicy file applied as a device-scope policy source; empty disables")
|
|
loadSyspolicy.Set(func() {
|
|
if syspolicyFile == "" {
|
|
return
|
|
}
|
|
if err := syspolicy.LoadJSONPolicyFile("JSONFile", syspolicyFile); err != nil {
|
|
log.Printf("%v", err)
|
|
}
|
|
})
|
|
}
|