netbird

mirror of https://github.com/netbirdio/netbird.git synced 2026-09-13 18:29:07 +02:00

Files

T

mlsmaycon 422912e7d5 read the console user's keychain through a user session helper

A root daemon cannot reach a login keychain: securityd is per session and a
key ACL needs a session to prompt in, so dropping uid is not enough. The
daemon now answers certificate challenges from the System keychain itself,
where MDM installs device identities, and launches "netbird posture
cert-proof" into the console user's desktop session with launchctl asuser
for the login keychain. Only the signature and the chain cross back, never
the private key.

The console user comes from SCDynamicStoreCopyConsoleUser, bound with purego
like the keychain calls. The login window reports no user, root, or
"loginwindow", and all three are treated as no keychain to read, so a Mac at
the lock screen sends device proofs alone.

Adds info logging across the path: the keychain search list, per class query
status and item counts, the chain built per candidate, and the verification
error for every rejected candidate. A run that sends nothing now says why.

README.md documents the trust model, the console user limitation and how to
read the logs.

2026-09-13 14:40:23 +02:00

common

[client] Remove select account prompt (#4912 )

2025-12-04 14:57:29 +01:00

rest

[management] Rework Agent Network endpoint identity and settings bootstrap (#7085 )

2026-08-10 19:06:55 +02:00

client_test.go

[client] Gather fresh system info on every management sync stream connect (#7409 )

2026-09-04 15:07:01 +02:00

client.go

[client] Gather fresh system info on every management sync stream connect (#7409 )