mirror of
https://github.com/tailscale/tailscale.git
synced 2026-09-15 23:42:48 -04:00
Brad Fitzpatrick
c14f706404
"tailscale login" first switches to a new empty profile before starting the login flow. Switching reset the prefs to defaults, clearing OperatorUser, so a non-root operator lost LocalAPI write access partway through the command: the profile switch itself succeeded, then the following check-prefs request failed with "checkprefs access denied". Worse, the operator setting was lost entirely, so subsequent attempts failed earlier with "profiles access denied". This made the long-suggested advice of running "sudo tailscale set --operator=$USER" not work for logging in. Carry OperatorUser over to the new profile's prefs. It is a machine-local administrative setting rather than an account setting, and only actors that already have write access can initiate a profile switch, so this grants no new access. Fixes #18294 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Change-Id: Ia4c4336d211e489dd268b428aad3a0bf55e70ad8