sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-03 12:09:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

[client] Gate remote jobs behind an admin opt-in with MDM support

Browse Source 
Remote jobs (debug bundles requested by the management server) run on the
peer with no local consent. This makes them an explicit opt-in, mirroring
the SSH-server opt-in: an --allow-remote-jobs flag persisted in the client
config, defaulting off. Enabling it off->on crosses the user-to-root
boundary and is refused for unprivileged IPC callers by the daemon gate,
the same way enabling the SSH server is. When disabled, the job-stream
handler refuses every job before doing any work.

Because the flag is admin-controlled, it is also MDM-managed: the
allowRemoteJobs policy key can enable or lock it, and a user SetConfig that
diverges from an enforced value is rejected like the other managed fields.

A second MDM key, debugBundleUploadURL, overrides the debug-bundle upload
service for remote jobs, taking precedence over the management-supplied
value (MDM > management > default). This lets an operator pin uploads to a
trusted host regardless of what management requests. The override is
validated as an https URL with a host, the same as the management value.

Defaulting the opt-in off is a behavior change: existing deployments that
rely on management-triggered debug bundles must opt in (flag or MDM) before
they work again.
This commit is contained in:
mlsmaycon
2026-08-13 02:12:47 +09:00
committed by Maycon Santos
parent d32573020a
commit 7da4127c7d
15 changed files with 227 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/io.netbird.client.plist
+15
View File
@@ -85,6 +85,21 @@
<false/>
-->
<!-- ===== Remote jobs (debug bundles) =====
allowRemoteJobs : opt this device into management-requested
remote jobs (e.g. debug bundles). Off by
default; enabling is a privileged change.
debugBundleUploadURL : override the debug-bundle upload service URL
for remote jobs (https URL with a host). Takes
precedence over the management-supplied value. -->
<!--
<key>allowRemoteJobs</key>
<true/>
<key>debugBundleUploadURL</key>
<string>https://upload.example.com</string>
-->
<!-- ===== WireGuard UDP port =====
Range 1-65535. Omit to keep the daemon default. -->
<!--