mirror of
https://github.com/tailscale/tailscale.git
synced 2026-09-22 19:45:15 -04:00
Patrick O'Doherty
2e72593fbf
The update/install localapi handler had no PermitWrite check, so any local user who could reach the localapi socket could make the root daemon self-update and restart itself. This has been the case since the endpoint was added in November 2023. Gate the handler behind PermitWrite so that only root or the operator user can trigger a self-update, matching the other mutating handlers. Updates tailscale/corp#48187 Change-Id: Iadfef939f5dab684652cd220e77de63b54bfca2f Reported-by: Ben Carman <benthecarman@live.com> Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>
27 lines
768 B
Go
27 lines
768 B
Go
// Copyright (c) Tailscale Inc & contributors
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
package clientupdate
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"tailscale.com/ipn/localapi"
|
|
"tailscale.com/util/httpm"
|
|
)
|
|
|
|
// TestServeUpdateInstallRequiresWrite verifies that the update/install
|
|
// localapi handler denies requests from clients without write permission,
|
|
// i.e. non-root, non-operator local users.
|
|
func TestServeUpdateInstallRequiresWrite(t *testing.T) {
|
|
h := &localapi.Handler{PermitWrite: false}
|
|
rec := httptest.NewRecorder()
|
|
req := httptest.NewRequest(httpm.POST, "/localapi/v0/update/install", nil)
|
|
serveUpdateInstall(h, rec, req)
|
|
if rec.Code != http.StatusForbidden {
|
|
t.Fatalf("status = %d, want %d", rec.Code, http.StatusForbidden)
|
|
}
|
|
}
|