version: add IsMacSysExt func

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

version/prop.go

@@ -6,8 +6,10 @@ package version
 
 import (
 	"os"
+	"path/filepath"
 	"runtime"
 	"strings"
+	"sync/atomic"
 )
 
 // IsMobile reports whether this is a mobile client build.
@@ -28,12 +30,35 @@ func OS() string {
 }
 
 // IsSandboxedMacOS reports whether this process is a sandboxed macOS
-// (GUI) process. It is true for the Mac App Store and macsys (System
+// process. It is true for the Mac App Store and macsys (System
 // Extension) version on macOS, and false for tailscaled-on-macOS.
 func IsSandboxedMacOS() bool {
 	if runtime.GOOS != "darwin" {
 		return false
 	}
+	if IsMacSysExt() {
+		return true
+	}
 	exe, _ := os.Executable()
 	return strings.HasSuffix(exe, "/Contents/MacOS/Tailscale")
 }
+
+var isMacSysExt atomic.Value
+
+// IsMacSysExt whether this binary is from the standalone "System
+// Extension" (a.k.a. "macsys") version of Tailscale for macOS.
+func IsMacSysExt() bool {
+	if runtime.GOOS != "darwin" {
+		return false
+	}
+	if b, ok := isMacSysExt.Load().(bool); ok {
+		return b
+	}
+	exe, err := os.Executable()
+	if err != nil {
+		return false
+	}
+	v := filepath.Base(exe) == "io.tailscale.ipn.macsys.network-extension"
+	isMacSysExt.Store(v)
+	return v
+}