diff options
| author | Will Norris <will@tailscale.com> | 2024-01-10 13:58:51 -0800 |
|---|---|---|
| committer | Will Norris <will@willnorris.com> | 2024-01-12 14:37:53 -0800 |
| commit | 236531c5fc6d7295f8832f47a569e49fceca76eb (patch) | |
| tree | 88209cf2b907a3a3bacd9e8a399dee8761d6ffde /util/execqueue | |
| parent | 7100b6e72162d532efd10021e47b710fc10c9b64 (diff) | |
| download | tailscale-236531c5fc6d7295f8832f47a569e49fceca76eb.tar.xz tailscale-236531c5fc6d7295f8832f47a569e49fceca76eb.zip | |
ipn/ipnserver: always allow Windows SYSTEM user to connect
When establishing connections to the ipnserver, we validate that the
local user is allowed to connect. If Tailscale is currently being
managed by a different user (primarily for multi-user Windows installs),
we don't allow the connection.
With the new device web UI, the inbound connection is coming from
tailscaled itself, which is often running as "NT AUTHORITY\SYSTEM".
In this case, we still want to allow the connection, even though it
doesn't match the user running the Tailscale GUI. The SYSTEM user has
full access to everything on the system anyway, so this doesn't escalate
privileges.
Eventually, we want the device web UI to run outside of the tailscaled
process, at which point this exception would probably not be needed.
Updates tailscale/corp#16393
Signed-off-by: Will Norris <will@tailscale.com>
Diffstat (limited to 'util/execqueue')
0 files changed, 0 insertions, 0 deletions