mirrors/tailscale
1
0
Fork 0
Code Issues Pull Requests Projects Wiki Activity

ipn/ipnlocal,clientupdate: disallow auto-updates in containers (#11814)

Browse Source 
Containers are typically immutable and should be updated as a whole (and
not individual packages within). Deny enablement of auto-updates in
containers.

Also, add the missing check in EditPrefs in LocalAPI, to catch cases
like tailnet default auto-updates getting enabled for nodes that don't
support it.

Updates #11544

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
This commit is contained in:
Andrew Lytvynov
2024-04-19 13:37:21 -07:00
committed by GitHub
parent b3fb3bf084
commit bff527622d
3 changed files with 62 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
clientupdate/clientupdate.go
View File

@ -29,6 +29,7 @@ import (
"github.com/google/uuid"
"tailscale.com/clientupdate/distsign"
"tailscale.com/hostinfo"
"tailscale.com/types/logger"
"tailscale.com/util/cmpver"
"tailscale.com/util/winutil"
@ -162,9 +163,10 @@ func NewUpdater(args Arguments) (*Updater, error) {
type updateFunction func() error
func (up *Updater) getUpdateFunction() (fn updateFunction, canAutoUpdate bool) {
canAutoUpdate = !hostinfo.New().Container.EqualBool(true) // EqualBool(false) would return false if the value is not set.
switch runtime.GOOS {
case "windows":
return up.updateWindows, true
return up.updateWindows, canAutoUpdate
case "linux":
switch distro.Get() {
case distro.NixOS:
@ -178,20 +180,20 @@ func (up *Updater) getUpdateFunction() (fn updateFunction, canAutoUpdate bool) {
// auto-update mechanism.
return up.updateSynology, false
case distro.Debian: // includes Ubuntu
return up.updateDebLike, true
return up.updateDebLike, canAutoUpdate
case distro.Arch:
if up.archPackageInstalled() {
// Arch update func just prints a message about how to update,
// it doesn't support auto-updates.
return up.updateArchLike, false
}
return up.updateLinuxBinary, true
return up.updateLinuxBinary, canAutoUpdate
case distro.Alpine:
return up.updateAlpineLike, true
return up.updateAlpineLike, canAutoUpdate
case distro.Unraid:
return up.updateUnraid, true
return up.updateUnraid, canAutoUpdate
case distro.QNAP:
return up.updateQNAP, true
return up.updateQNAP, canAutoUpdate
}
switch {
case haveExecutable("pacman"):
@ -200,21 +202,21 @@ func (up *Updater) getUpdateFunction() (fn updateFunction, canAutoUpdate bool) {
// it doesn't support auto-updates.
return up.updateArchLike, false
}
return up.updateLinuxBinary, true
return up.updateLinuxBinary, canAutoUpdate
case haveExecutable("apt-get"): // TODO(awly): add support for "apt"
// The distro.Debian switch case above should catch most apt-based
// systems, but add this fallback just in case.
return up.updateDebLike, true
return up.updateDebLike, canAutoUpdate
case haveExecutable("dnf"):
return up.updateFedoraLike("dnf"), true
return up.updateFedoraLike("dnf"), canAutoUpdate
case haveExecutable("yum"):
return up.updateFedoraLike("yum"), true
return up.updateFedoraLike("yum"), canAutoUpdate
case haveExecutable("apk"):
return up.updateAlpineLike, true
return up.updateAlpineLike, canAutoUpdate
}
// If nothing matched, fall back to tarball updates.
if up.Update == nil {
return up.updateLinuxBinary, true
return up.updateLinuxBinary, canAutoUpdate
}
case "darwin":
switch {
@ -230,7 +232,7 @@ func (up *Updater) getUpdateFunction() (fn updateFunction, canAutoUpdate bool) {
return nil, false
}
case "freebsd":
return up.updateFreeBSD, true
return up.updateFreeBSD, canAutoUpdate
}
return nil, false
}