mirror of
https://github.com/tailscale/tailscale.git
synced 2026-09-13 14:29:49 -04:00
Mike JensenandPatrick O'Doherty
fc983df38c
Previously the acceptEnv variables forwarded to the incubator child were
JSON-encoded onto its command line (--encoded-env), so their values were
visible in /proc/<pid>/cmdline to any other local user and were logged in
the session-start argv (locally and to log.tailscale.com except where
--no-logs-no-support was specified).
This change now carries those variables through an os.Pipe file
descriptor as a json encoded payload. Added end-to-end testing
helps validate secrets reach the session but are not in flags or logged.
Fixes tailscale/corp#44903
Change-Id: I5b137b20e9c06feec6b70aaf4e6925e6db74017e
Change-Id: Ic91d11a967fae6c86459de43dff2732f9e807859
(cherry picked from commit 9d48dbd561)
Signed-off-by: Mike Jensen <mikej@tailscale.com>
Co-authored-by: Patrick O'Doherty <patrick@tailscale.com>