mirror of
https://github.com/tailscale/tailscale.git
synced 2026-07-20 21:23:07 +08:00
Patrick O'Doherty
797fa5b9bc
Previously the acceptEnv variables forwarded to the incubator child were JSON-encoded onto its command line (--encoded-env), so their values were visible in /proc/<pid>/cmdline to any other local user and were logged in the session-start argv (locally and to log.tailscale.com except where --no-logs-no-support was specified). Carry the accepted "KEY=VALUE" pairs to the child via its environment (cmd.Env) instead of the argv. The key names are carried alongside them in a dedicated TS_SSH_ALLOWED_ENV_KEYS variable rather than on the argv, so the incubator can rebuild the "su -w" allowlist. The incubator strips TS_SSH_ALLOWED_ENV_KEYS from the environment before handing off to the user's process. Adds incubator_test.go and accept_env_test.go coverage: a forwarded secret is delivered via cmd.Env and neither its value nor its key name appears on cmd.Args. Updates tailscale/corp#44903 Signed-off-by: Patrick O'Doherty <[email protected]>