webnet/tailscale
1
0
Fork 0
Code Issues 1 Pull Requests 1 Packages Projects Releases Wiki Activity

ipn,ipn/localapi: require local admin to serve Unix domain sockets

Browse Source 
This resolves a local privilege escalation (LPE). Prior to this change,
a non-admin user could utilize serve to access local Unix sockets they
otherwise should not be able to access. For example,

  tailscale serve --http 80 unix:/var/run/docker.sock

would give the user access to the Docker socket (usually root only).
This works because tailscaled has root access and implements the proxy
to the socket (see also: 'the confused deputy problem').

We resolve the problem by refusing to serve Unix targets altogether
unless instructed to by a root user.

Thanks to Tim Sageser (dtrsecurity) for this report.

Fixes tailscale/corp#41998

Signed-off-by: Harry Harpham <harry@tailscale.com>
This commit is contained in:
Harry Harpham
2026-06-03 09:45:02 -06:00
parent 40c98cd267
commit fa542426e5
4 changed files with 217 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ipn/localapi/localapi_test.go
+25 -1
View File
@@ -535,7 +535,7 @@ func TestShouldDenyServeConfigForGOOSAndUserContext(t *testing.T) {
wantErr bool
}{
{
name: "not-path-handler",
name: "not-path-or-unix-handler",
configIn: &ipn.ServeConfig{
Web: map[ipn.HostPort]*ipn.WebServerConfig{
"foo.test.ts.net:443": {Handlers: map[string]*ipn.HTTPHandler{
@@ -570,6 +570,30 @@ func TestShouldDenyServeConfigForGOOSAndUserContext(t *testing.T) {
h: newHandler(false),
wantErr: true,
},
{
name: "unix-handler-admin",
configIn: &ipn.ServeConfig{
Web: map[ipn.HostPort]*ipn.WebServerConfig{
"foo.test.ts.net:443": {Handlers: map[string]*ipn.HTTPHandler{
"/": {Proxy: "unix:/var/run/foo.sock"},
}},
},
},
h: newHandler(true),
wantErr: false,
},
{
name: "unix-handler-not-admin",
configIn: &ipn.ServeConfig{
Web: map[ipn.HostPort]*ipn.WebServerConfig{
"foo.test.ts.net:443": {Handlers: map[string]*ipn.HTTPHandler{
"/": {Proxy: "unix:/var/run/foo.sock"},
}},
},
},
h: newHandler(false),
wantErr: true,
},
}
for _, tt := range tests {
ipn/localapi/serve.go
+5 -4
View File
@@ -53,7 +53,8 @@ func (h *Handler) serveServeConfig(w http.ResponseWriter, r *http.Request) {
return
}
// require a local admin when setting a path handler
// require a local admin when setting a path handler or serving a Unix
// domain socket
// TODO: roll-up this Windows-specific check into either PermitWrite
// or a global admin escalation check.
if err := authorizeServeConfigForGOOSAndUserContext(runtime.GOOS, configIn, h); err != nil {
@@ -89,7 +90,7 @@ func authorizeServeConfigForGOOSAndUserContext(goos string, configIn *ipn.ServeC
if goos == "darwin" && version.IsSandboxedMacOS() {
return nil
}
if !configIn.HasPathHandler() {
if !configIn.HasPathHandler() && !configIn.IsServingUnixAny() {
return nil
}
if h.Actor.IsLocalAdmin(h.b.OperatorUserID()) {
@@ -97,9 +98,9 @@ func authorizeServeConfigForGOOSAndUserContext(goos string, configIn *ipn.ServeC
}
switch goos {
case "windows":
return errors.New("must be a Windows local admin to serve a path")
return errors.New("must be a Windows local admin to serve a path or Unix socket")
case "linux", "darwin", "illumos", "solaris":
return errors.New("must be root, or be an operator and able to run 'sudo tailscale' to serve a path")
return errors.New("must be root, or be an operator and able to run 'sudo tailscale' to serve a path or Unix socket")
default:
// We filter goos at the start of the func, this default case
// should never happen.
ipn/serve.go
+40
View File
@@ -264,6 +264,46 @@ func (sc *ServeConfig) HasPathHandler() bool {
return false
}
// IsServingUnixAny reports whether ServeConfig is serving Unix targets on any
// port or web handler.
func (sc *ServeConfig) IsServingUnixAny() bool {
if sc == nil {
return false
}
for _, fgSrvCfg := range sc.Foreground {
if fgSrvCfg.IsServingUnixAny() {
return true
}
}
for _, ph := range sc.TCP {
if strings.HasPrefix(ph.TCPForward, "unix:") {
return true
}
}
for _, web := range sc.Web {
for _, h := range web.Handlers {
if strings.HasPrefix(h.Proxy, "unix:") {
return true
}
}
}
for _, svcCfg := range sc.Services {
for _, ph := range svcCfg.TCP {
if strings.HasPrefix(ph.TCPForward, "unix:") {
return true
}
}
for _, web := range svcCfg.Web {
for _, h := range web.Handlers {
if strings.HasPrefix(h.Proxy, "unix:") {
return true
}
}
}
}
return false
}
// IsTCPForwardingAny reports whether ServeConfig is currently forwarding in
// TCPForward mode on any port. This is exclusive of Web/HTTPS serving.
func (sc *ServeConfig) IsTCPForwardingAny() bool {
ipn/serve_test.go
+147
View File
@@ -417,3 +417,150 @@ func TestIsFunnelOn(t *testing.T) {
})
}
}
func TestIsServingUnixAny(t *testing.T) {
tests := []struct {
name string
sc *ServeConfig
want bool
}{
{
name: "empty",
sc: &ServeConfig{},
want: false,
},
{
name: "nil",
sc: &ServeConfig{},
want: false,
},
{
name: "no_unix",
sc: &ServeConfig{
TCP: map[uint16]*TCPPortHandler{
80: {TCPForward: "localhost:8080"},
},
},
want: false,
},
{
name: "tcp_to_unix",
sc: &ServeConfig{
TCP: map[uint16]*TCPPortHandler{
80: {TCPForward: "unix:/var/run/foo.sock"},
},
},
want: true,
},
{
name: "web_to_unix",
sc: &ServeConfig{
Web: map[HostPort]*WebServerConfig{
"foo.test.ts.net:80": {
Handlers: map[string]*HTTPHandler{
"/": {Proxy: "unix:/var/run/foo.sock"},
},
},
},
},
want: true,
},
{
name: "foreground_tcp_to_unix",
sc: &ServeConfig{
Foreground: map[string]*ServeConfig{
"abc": {
TCP: map[uint16]*TCPPortHandler{
80: {TCPForward: "unix:/var/run/foo.sock"},
},
},
},
},
want: true,
},
{
name: "foreground_web_to_unix",
sc: &ServeConfig{
Foreground: map[string]*ServeConfig{
"abc": {
Web: map[HostPort]*WebServerConfig{
"foo.test.ts.net:80": {
Handlers: map[string]*HTTPHandler{
"/": {Proxy: "unix:/var/run/foo.sock"},
},
},
},
},
},
},
want: true,
},
{
name: "services_tcp_to_unix",
sc: &ServeConfig{
Services: map[tailcfg.ServiceName]*ServiceConfig{
"svc:foo": {
TCP: map[uint16]*TCPPortHandler{
80: {TCPForward: "unix:/var/run/foo.sock"},
},
},
},
},
want: true,
},
{
name: "services_web_to_unix",
sc: &ServeConfig{
Services: map[tailcfg.ServiceName]*ServiceConfig{
"svc:foo": {
Web: map[HostPort]*WebServerConfig{
"foo.test.ts.net:80": {
Handlers: map[string]*HTTPHandler{
"/": {Proxy: "unix:/var/run/foo.sock"},
},
},
},
},
},
},
want: true,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
if got := tt.sc.IsServingUnixAny(); got != tt.want {
t.Errorf("ServeConfig.IsServingUnixAny() = %v, want %v", got, tt.want)
}
})
}
}
// The structural checks below guard against new vulnerabilities in serving Unix
// socket targets. If [ServeConfig] or [ServiceConfig] is updated, these checks
// will fail, forcing you to consider updating [ServeConfig.IsServingUnixAny].
//
// If your updates have created a new way to serve Unix sockets, please update
// IsServingUnixAny accordingly. Otherwise, you can just add your new field
// below and move on.
//
// IsServingUnixAny helps avoid a class of vulnerabilities in which tailscaled
// (by means of tailscale serve) gives non-root users access to Unix sockets
// they otherwise would not have access to (e.g. /var/run/docker.sock). As of
// 2026-06-03, serving Unix sockets at all requires root permissions, and
// IsServingUnixAny is how tailscaled knows when to enforce this restriction.
//
// See https://github.com/tailscale/corp/issues/41998
var _ ServeConfig = struct {
TCP map[uint16]*TCPPortHandler `json:",omitempty"`
Web map[HostPort]*WebServerConfig `json:",omitempty"`
Services map[tailcfg.ServiceName]*ServiceConfig `json:",omitempty"`
AllowFunnel map[HostPort]bool `json:",omitempty"`
Foreground map[string]*ServeConfig `json:",omitempty"`
ETag string `json:"-"`
}{}
var _ ServiceConfig = struct {
TCP map[uint16]*TCPPortHandler `json:",omitempty"`
Web map[HostPort]*WebServerConfig `json:",omitempty"`
Tun bool `json:",omitempty"`
}{}