sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-11 17:29:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

Make session key authorization atomic, unblock the encoder on teardown, drop agent privileges unconditionally

Browse Source
This commit is contained in:
Viktor Liu
2026-08-29 09:12:33 +02:00
parent 8b719f0b4e
commit 42450dbfbe
7 changed files with 119 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/cmd/vnc_agent.go
+8 -6
View File
@@ -55,12 +55,14 @@ var vncAgentCmd = &cobra.Command{
// the listening socket: keeps a post-auth bug in the encoder /
// input / capture paths confined to the user's own privileges
// rather than escalating to host root, and makes the daemon's
// LOCAL_PEERCRED check see the right uid. No-op on Windows
// (both processes run as SYSTEM) and when --target-uid is 0.
if vncAgentTargetUID != 0 {
if err := dropAgentPrivileges(vncAgentTargetUID); err != nil {
return fmt.Errorf("drop privileges to uid %d: %w", vncAgentTargetUID, err)
}
// LOCAL_PEERCRED check see the right uid. No-op on Windows, where
// both processes run as SYSTEM.
//
// Called unconditionally: a missing or zero --target-uid is exactly
// the case the Darwin implementation refuses, and skipping the call
// for it would leave the agent running as root instead.
if err := dropAgentPrivileges(vncAgentTargetUID); err != nil {
return fmt.Errorf("drop privileges to uid %d: %w", vncAgentTargetUID, err)
}
if err := os.Remove(vncAgentSocket); err != nil && !os.IsNotExist(err) {