85 lines
1.7 KiB
Go
Raw Normal View History

uti/syspolicy: user policy support, auto-refresh and initial preparation for policy structs This updates the syspolicy package to support multiple policy sources in the three policy scopes: user, profile, and device, and provides a merged resultant policy. A policy source is a syspolicy/source.Store that has a name and provides access to policy settings for a given scope. It can be registered with syspolicy/rsop.RegisterStore. Policy sources and policy stores can be either platform-specific or platform-agnostic. On Windows, we have the Registry-based, platform-specific policy store implemented as syspolicy/source.PlatformPolicyStore. This store provides access to the Group Policy and MDM policy settings stored in the Registry. On other platforms, we currently provide a wrapper that converts a syspolicy.Handler into a syspolicy/source.Store. However, we should update them in follow-up PRs. An example of a platform-agnostic policy store would be a policy deployed from the control, a local policy config file, or even environment variables. We maintain the current, most recent version of the resultant policy for each scope in an rsop.Policy. This is done by reading and merging the policy settings from the registered stores the first time the resultant policy is requested, then re-reading and re-merging them if a store implements the source.Changeable interface and reports a policy change. Policy change notifications are debounced to avoid re-reading policy settings multiple times if there are several changes within a short period. The rsop.Policy can notify clients if the resultant policy has changed. However, we do not currently expose this via the syspolicy package and plan to do so differently along with a struct-based policy hierarchy in the next PR. To facilitate this, all policy settings should be registered with the setting.Register function. The syspolicy package does this automatically for all policy settings defined in policy_keys.go. The new functionality is available through the existing syspolicy.Read* set of functions. However, we plan to expose it via a struct-based policy hierarchy, along with policy change notifications that other subsystems can use, in the next PR. We also plan to send the resultant policy back from tailscaled to the clients via the LocalAPI. This is primarily a foundational PR to facilitate future changes, but the immediate observable changes on Windows include: - The service will use the current policy setting values instead of those read at OS boot time. - The GUI has access to policy settings configured on a per-user basis. On Android: - We now report policy setting usage via clientmetrics. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2024-08-02 19:18:42 -05:00
// Copyright (c) Tailscale Inc & AUTHORS
// SPDX-License-Identifier: BSD-3-Clause
// The lazyinit package facilitates deferred package initialization.
package lazyinit
import (
"sync"
"sync/atomic"
)
var packageInit deferredOnce
// Defer defers the specified action until [Do] is called.
// It returns a boolean indicating whether [Do] has already been called.
func Defer(action func() error) bool {
return packageInit.Defer(action)
}
// DeferWithCleanup is like [Defer], but the action function returns a cleanup
// function to be called in case of an error.
func DeferWithCleanup(action func() (cleanup func(), err error)) bool {
return packageInit.DeferWithCleanup(action)
}
// Do runs all deferred functions and returns an error if any of them fail.
func Do() error {
return packageInit.Do()
}
type deferredOnce struct {
done atomic.Uint32
err error
m sync.Mutex
funcs []func() (cleanup func(), err error)
}
func (o *deferredOnce) Defer(action func() error) bool {
return o.DeferWithCleanup(func() (cleanup func(), err error) {
return nil, action()
})
}
func (o *deferredOnce) DeferWithCleanup(action func() (cleanup func(), err error)) bool {
o.m.Lock()
defer o.m.Unlock()
if o.done.Load() != 0 {
return false
}
o.funcs = append(o.funcs, action)
return true
}
func (o *deferredOnce) Do() error {
if o.done.Load() == 0 {
o.doSlow()
}
return o.err
}
func (o *deferredOnce) doSlow() (err error) {
o.m.Lock()
defer o.m.Unlock()
if o.done.Load() == 0 {
defer func() {
o.done.Store(1)
o.err = err
}()
for _, f := range o.funcs {
cleanup, err := f()
if err != nil {
return err
}
if cleanup != nil {
defer func() {
if err != nil {
cleanup()
}
}()
}
}
}
return o.err
}