mirror of
https://github.com/netbirdio/netbird.git
synced 2026-08-29 02:51:29 +02:00
7da4127c7d
Remote jobs (debug bundles requested by the management server) run on the peer with no local consent. This makes them an explicit opt-in, mirroring the SSH-server opt-in: an --allow-remote-jobs flag persisted in the client config, defaulting off. Enabling it off->on crosses the user-to-root boundary and is refused for unprivileged IPC callers by the daemon gate, the same way enabling the SSH server is. When disabled, the job-stream handler refuses every job before doing any work. Because the flag is admin-controlled, it is also MDM-managed: the allowRemoteJobs policy key can enable or lock it, and a user SetConfig that diverges from an enforced value is rejected like the other managed fields. A second MDM key, debugBundleUploadURL, overrides the debug-bundle upload service for remote jobs, taking precedence over the management-supplied value (MDM > management > default). This lets an operator pin uploads to a trusted host regardless of what management requests. The override is validated as an https URL with a host, the same as the management value. Defaulting the opt-in off is a behavior change: existing deployments that rely on management-triggered debug bundles must opt in (flag or MDM) before they work again.
14 lines
576 B
Go
14 lines
576 B
Go
package cmd
|
|
|
|
// remoteJobsAllowedFlag opts this peer into running remote jobs (e.g. debug
|
|
// bundles) requested by the management server. It defaults to false: remote
|
|
// jobs are an explicit opt-in, and enabling it is a privileged change (see the
|
|
// daemon gate in client/server), mirroring the SSH server opt-in.
|
|
const remoteJobsAllowedFlag = "allow-remote-jobs"
|
|
|
|
var remoteJobsAllowed bool
|
|
|
|
func init() {
|
|
upCmd.PersistentFlags().BoolVar(&remoteJobsAllowed, remoteJobsAllowedFlag, false, "Allow the management server to run remote jobs (e.g. debug bundles) on this peer")
|
|
}
|