tailscale

0 Fork 0

mirror of https://github.com/tailscale/tailscale.git synced 2026-11-06 09:33:17 -05:00

Files

T

Brendan Creane e7f595b491 ipn/ipnserver, ipn/localapi: require root to serve a path or Unix socket

The operator user could serve a path or Unix socket if tailscaled
found a sudo rule for them, but the check used the GECOS display name
and so failed for most users with a 401. The check cannot be repaired
safely: listing another user's sudo rules never prompts, so it proves
a rule exists, not that the user has authenticated. An operator who
had not entered their sudo password could serve any root-readable file
or root-only socket. Require root instead and say so in the error.

Fixes #21204
Fixes #21985
Fixes #21988

Signed-off-by: Brendan Creane <bcreane@gmail.com>

2026-11-03 14:39:07 -08:00

cert.go

ipn/localapi,client/local: honour Retry-After on cert rate-limit (#20315 )

2026-07-08 13:34:40 +01:00

debug_test.go

ipn/localapi: restrict debug-log access to PermitWrite (#21447 )

2026-09-25 12:29:56 -06:00

debug.go

ipn/localapi: restrict debug-log access to PermitWrite (#21447 )

2026-09-25 12:29:56 -06:00

debugderp.go

tailcfg: replace int with DERPRegionID for additional type safety (#20646 )