Mike Jensen 94ea82ab55 ipn/localapi: restrict debug-log access to PermitWrite (#21447) ...

The debug-log endpoint was gated on PermitRead, which any local user connecting to the world-writable tailscaled socket passes. Although forged log entries are always possible, we should limit the ability for local users to influence that flow with respects to a given node.

This change requires PermitWrite for debug-log, matching the trust level of every other mutating debug endpoint. Also add a buildfeatures.HasDebug guard to debug-dial-types for parity with serveDebug.

Fixes tailscale/corp#48143

Change-Id: I0c0044b6b44fe7cbfb6734ac18bca3dc36eaffbf

Signed-off-by: Mike Jensen <mikej@tailscale.com>

2026-09-25 12:29:56 -06:00

..

cert.go

ipn/localapi,client/local: honour Retry-After on cert rate-limit (#20315)

2026-07-08 13:34:40 +01:00

debug_test.go

ipn/localapi: restrict debug-log access to PermitWrite (#21447)

2026-09-25 12:29:56 -06:00

debug.go

ipn/localapi: restrict debug-log access to PermitWrite (#21447)

2026-09-25 12:29:56 -06:00

debugderp.go

tailcfg: replace int with DERPRegionID for additional type safety (#20646)

2026-08-19 16:25:50 -07:00

disabled_stubs.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

localapi_drive.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

localapi_test.go

ipn/localapi: restrict debug-log access to PermitWrite (#21447)

2026-09-25 12:29:56 -06:00

localapi.go

ipn, ipn/ipnlocal: remove Notify.NetMap, size initial status to subscription

2026-09-14 09:37:30 -07:00

pprof.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

serve.go

ipn,ipn/localapi: require local admin to serve Unix domain sockets

2026-06-03 09:45:02 -06:00

syspolicy_api.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

tailnetlock.go

all: rename NetworkLock functions/types to TailnetLock

2026-06-08 13:14:28 +01:00