James Tucker 7dbc80ab71 ssh/tailssh: hand the agent forwarding dir to the user, remove it on session end ...

The agent forwarding socket's temp directory was left root-owned and
chmod 0755, letting every local user reach other users' agent sockets.
Chown the directory to the session user and keep it 0700 (the socket is
already 0600 and chowned first), like sshd's agent forwarding, and
remove the directory when the session ends instead of only closing the
listener.

Updates tailscale/corp#50380

Signed-off-by: James Tucker <james@tailscale.com>

2026-10-24 13:52:38 -07:00

..

testcontainers

ssh/tailssh: speed up SSH integration tests

2026-04-13 14:18:27 -07:00

accept_env_test.go

ssh/tailssh: extend dangerous env var denylist, re-check child-side

2026-10-24 12:41:58 -07:00

accept_env.go

ssh/tailssh: extend dangerous env var denylist, re-check child-side

2026-10-24 12:41:58 -07:00

auditd_linux_test.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

auditd_linux.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

c2n.go

ssh/tailssh: split the OS-specific parts of the server into their own files

2026-09-15 19:32:40 -07:00

hostkeys_test.go

ssh/tailssh: write private host keys with 0600 permissions

2026-10-24 13:30:41 -07:00

hostkeys.go

ssh/tailssh: write private host keys with 0600 permissions

2026-10-24 13:30:41 -07:00

incubator_linux.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

incubator_plan9.go

ssh/tailssh: extend dangerous env var denylist, re-check child-side

2026-10-24 12:41:58 -07:00

incubator_test.go

ssh/tailssh: extend dangerous env var denylist, re-check child-side

2026-10-24 12:41:58 -07:00

incubator.go

ssh/tailssh: extend dangerous env var denylist, re-check child-side

2026-10-24 12:41:58 -07:00

listen.go

feature: add TS_DISABLE_FEATURE to disable features at runtime

2026-09-15 08:37:47 -07:00

localstate_test.go

format using go fmt version 1.27.2 (#21838)

2026-10-21 23:17:21 -07:00

privs_test.go

tstest: add RequireRoot helper

2026-04-10 10:48:50 -07:00

process_unix_test.go

ssh/tailssh: hand the agent forwarding dir to the user, remove it on session end

2026-10-24 13:52:38 -07:00

process_unix.go

ssh/tailssh: hand the agent forwarding dir to the user, remove it on session end

2026-10-24 13:52:38 -07:00

session.go

tsnet: add opt-in SSH support (Server.ListenSSH)

2026-05-30 14:17:50 -07:00

sftp.go

ssh/tailssh: split the OS-specific parts of the server into their own files

2026-09-15 19:32:40 -07:00

tailssh_exitcodes_test.go

ssh/tailssh: test exit-status frame ordering and stderr drain

2026-07-30 10:18:00 +02:00

tailssh_frameorder_test.go

ssh/tailssh: test exit-status frame ordering and stderr drain

2026-07-30 10:18:00 +02:00

tailssh_integration_exitcodes_test.go

ssh/tailssh: add exit-status test harness

2026-07-30 10:18:00 +02:00

tailssh_integration_test.go

ssh/tailssh: dup the pty master with F_DUPFD_CLOEXEC (#21342)

2026-10-16 17:45:34 -07:00

tailssh_test.go

ssh/tailssh: pin rejection-banner content to policy-derived facts

2026-10-24 13:52:26 -07:00

tailssh.go

ssh/tailssh: hand the agent forwarding dir to the user, remove it on session end

2026-10-24 13:52:38 -07:00

user_unix.go

ssh/tailssh: treat numerically-zero uids as root in isRootUser

2026-10-24 13:23:22 -07:00

user.go

ssh/tailssh: split the OS-specific parts of the server into their own files

2026-09-15 19:32:40 -07:00