mirror of
https://github.com/tailscale/tailscale.git
synced 2026-10-09 11:52:00 -04:00
Brad Fitzpatrick
48ec6284d3
The pipe's security descriptor named the Administrators group as the pipe's owner (O:BA) and primary group (G:BA). Only administrators may assign that SID as an owner, so a tailscaled run by a regular user (in userspace-networking mode with its own --socket) died at startup with "This security ID may not be assigned as the owner of this object". The tests already had to swap in an empty descriptor to run unelevated. Neither part did anything for us. The primary group is never consulted by Windows access checks; it exists only for POSIX and NFS compatibility. The owner grants exactly one thing beyond the DACL: the right to read and rewrite the pipe's DACL. Whoever creates the pipe already has that in practice. For the default pipe name under ProtectedPrefix\Administrators, the creator must be an administrator (only administrators may create pipes with that prefix), so naming Administrators as owner gave them nothing new. A regular user creating a pipe of some other name runs the process that owns it and controls its DACL anyway. Who may connect is decided only by the DACL, which is unchanged: read and write for Users and LocalSystem. So drop the owner and group and let the creator own the pipe. While here, drop the AI, OI, and CI flags too: they concern inheritance to child objects, which a named pipe doesn't have, and were copied from a file system descriptor. The tests now use the real descriptor. Also give a pointer when listening on the default ProtectedPrefix\Administrators pipe fails with access denied. Updates #2791 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Change-Id: I8a1c3e5f7b9d2e4a6c8b0d2f4e6a8c0b2d4f6a8c