version: add IsSandboxedMacOS func

For when we need to tweak behavior or errors as a function of which of
3 macOS Tailscale variants we're using. (more accessors coming later
as needed)

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

version/prop.go

@@ -4,7 +4,11 @@
 
 package version
 
-import "runtime"
+import (
+	"os"
+	"runtime"
+	"strings"
+)
 
 // IsMobile reports whether this is a mobile client build.
 func IsMobile() bool {
@@ -22,3 +26,14 @@ func OS() string {
 	}
 	return runtime.GOOS
 }
+
+// IsSandboxedMacOS reports whether this process is a sandboxed macOS
+// (GUI) process. It is true for the Mac App Store and macsys (System
+// Extension) version on macOS, and false for tailscaled-on-macOS.
+func IsSandboxedMacOS() bool {
+	if runtime.GOOS != "darwin" {
+		return false
+	}
+	exe, _ := os.Executable()
+	return strings.HasSuffix(exe, "/Contents/MacOS/Tailscale")
+}