Brendan Creane e7f595b491 ipn/ipnserver, ipn/localapi: require root to serve a path or Unix socket ...

The operator user could serve a path or Unix socket if tailscaled
found a sudo rule for them, but the check used the GECOS display name
and so failed for most users with a 401. The check cannot be repaired
safely: listing another user's sudo rules never prompts, so it proves
a rule exists, not that the user has authenticated. An operator who
had not entered their sudo password could serve any root-readable file
or root-only socket. Require root instead and say so in the error.

Fixes #21204
Fixes #21985
Fixes #21988

Signed-off-by: Brendan Creane <bcreane@gmail.com>

2026-11-03 14:39:07 -08:00

..

auditlog

ipn/auditlog: store the audit log in the backend's state directory

2026-09-24 11:52:21 -07:00

conffile

ipn/conffile: reject null services and endpoints in Services config files (#21647)

2026-10-05 12:29:40 -07:00

desktop

ipn/desktop: skip the extension when sessions can't be enumerated

2026-09-24 11:51:51 -07:00

ipnauth

ipn/ipnserver, ipn/localapi: require root to serve a path or Unix socket

2026-11-03 14:39:07 -08:00

ipnext

ipn/ipnext: add NodeBackend.NodeBy{Addr,ID}

2026-10-16 12:45:54 -04:00

ipnlocal

appc,feature/conn25,tailcfg: read conn25 config from non-experimental nodeattr

2026-11-03 12:30:26 -05:00

ipnserver

ipn/ipnserver, ipn/localapi: require root to serve a path or Unix socket

2026-11-03 14:39:07 -08:00

ipnstate

types/key: rename NLPublic/Private to TLPublic/Private

2026-10-02 16:03:51 +01:00

lapitest

ipn/ipnlocal: consolidate test-only LocalBackend methods behind ForTest

2026-06-27 16:11:42 -07:00

localapi

ipn/ipnserver, ipn/localapi: require root to serve a path or Unix socket

2026-11-03 14:39:07 -08:00

policy

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

store

ipn/store/kubestore: omit ARI replaces for unstamped shared certs (#22053)

2026-10-31 11:43:17 +00:00

backend_test.go

ipn, ipn/ipnlocal: remove Notify.NetMap, size initial status to subscription

2026-09-14 09:37:30 -07:00

backend.go

ipn, ipn/local: expose hidden device gui gui_visibility (#21822)

2026-10-23 11:45:38 -07:00

conf_test.go

ipn/conf: support RemoteConfig in the config file

2026-07-14 10:29:19 +02:00

conf.go

ipn/conf: support RemoteConfig in the config file

2026-07-14 10:29:19 +02:00

doc.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

ipn_clone.go

control,ipn: add Tailnet hint for device registration

2026-11-02 09:22:43 -07:00

ipn_test.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

ipn_view.go

control,ipn: add Tailnet hint for device registration

2026-11-02 09:22:43 -07:00

prefs_test.go

control,ipn: add Tailnet hint for device registration

2026-11-02 09:22:43 -07:00

prefs.go

control,ipn: add Tailnet hint for device registration

2026-11-02 09:22:43 -07:00

serve_expand_test.go

ipn/ipnlocal,cmd/tailscale/cli: support unix socket targets for TCP serve

2026-07-16 09:13:38 -06:00

serve_test.go

cmd/tailscale: allow IPv6 localhost serve targets

2026-08-31 14:25:58 -07:00

serve.go

cmd/tailscale: allow IPv6 localhost serve targets

2026-08-31 14:25:58 -07:00

store_test.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

store.go

ipn/store: make WriteState(id, nil) delete key instead of adding nil entry (#19920)

2026-05-29 11:22:14 -07:00