mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-14 10:49:07 +02:00
mlsmaycon
422912e7d5
A root daemon cannot reach a login keychain: securityd is per session and a key ACL needs a session to prompt in, so dropping uid is not enough. The daemon now answers certificate challenges from the System keychain itself, where MDM installs device identities, and launches "netbird posture cert-proof" into the console user's desktop session with launchctl asuser for the login keychain. Only the signature and the chain cross back, never the private key. The console user comes from SCDynamicStoreCopyConsoleUser, bound with purego like the keychain calls. The login window reports no user, root, or "loginwindow", and all three are treated as no keychain to read, so a Mac at the lock screen sends device proofs alone. Adds info logging across the path: the keychain search list, per class query status and item counts, the chain built per candidate, and the verification error for every rejected candidate. A run that sends nothing now says why. README.md documents the trust model, the console user limitation and how to read the logs.
31 lines
984 B
Go
31 lines
984 B
Go
package cmd
|
|
|
|
import (
|
|
"github.com/spf13/cobra"
|
|
|
|
log "github.com/sirupsen/logrus"
|
|
|
|
"github.com/netbirdio/netbird/client/internal/certproof"
|
|
)
|
|
|
|
var postureCmd = &cobra.Command{
|
|
Use: "posture",
|
|
Short: "Posture helpers invoked by the NetBird daemon",
|
|
Hidden: true,
|
|
}
|
|
|
|
var postureCertProofCmd = &cobra.Command{
|
|
Use: "cert-proof",
|
|
Short: "Answer certificate posture challenges from the calling user's keychain",
|
|
Long: "Reads a certificate challenge set as JSON on stdin and writes the proofs as JSON on stdout.\n" +
|
|
"The daemon launches this in the console user's desktop session, because a login keychain\n" +
|
|
"cannot be reached from a root daemon. Not intended to be run by hand.",
|
|
Hidden: true,
|
|
SilenceUsage: true,
|
|
RunE: func(cmd *cobra.Command, args []string) error {
|
|
// Proofs travel on stdout, so every log line has to go elsewhere.
|
|
log.SetOutput(cmd.ErrOrStderr())
|
|
return certproof.RunHelper(cmd.Context(), cmd.InOrStdin(), cmd.OutOrStdout())
|
|
},
|
|
}
|