mirror of
https://github.com/tailscale/tailscale.git
synced 2024-11-25 19:15:34 +00:00
cab0e1a6f7
This updates the syspolicy package to support multiple policy sources in the three policy scopes: user, profile, and device, and provides a merged resultant policy. A policy source is a syspolicy/source.Store that has a name and provides access to policy settings for a given scope. It can be registered with syspolicy/rsop.RegisterStore. Policy sources and policy stores can be either platform-specific or platform-agnostic. On Windows, we have the Registry-based, platform-specific policy store implemented as syspolicy/source.PlatformPolicyStore. This store provides access to the Group Policy and MDM policy settings stored in the Registry. On other platforms, we currently provide a wrapper that converts a syspolicy.Handler into a syspolicy/source.Store. However, we should update them in follow-up PRs. An example of a platform-agnostic policy store would be a policy deployed from the control, a local policy config file, or even environment variables. We maintain the current, most recent version of the resultant policy for each scope in an rsop.Policy. This is done by reading and merging the policy settings from the registered stores the first time the resultant policy is requested, then re-reading and re-merging them if a store implements the source.Changeable interface and reports a policy change. Policy change notifications are debounced to avoid re-reading policy settings multiple times if there are several changes within a short period. The rsop.Policy can notify clients if the resultant policy has changed. However, we do not currently expose this via the syspolicy package and plan to do so differently along with a struct-based policy hierarchy in the next PR. To facilitate this, all policy settings should be registered with the setting.Register function. The syspolicy package does this automatically for all policy settings defined in policy_keys.go. The new functionality is available through the existing syspolicy.Read* set of functions. However, we plan to expose it via a struct-based policy hierarchy, along with policy change notifications that other subsystems can use, in the next PR. We also plan to send the resultant policy back from tailscaled to the clients via the LocalAPI. This is primarily a foundational PR to facilitate future changes, but the immediate observable changes on Windows include: - The service will use the current policy setting values instead of those read at OS boot time. - The GUI has access to policy settings configured on a per-user basis. On Android: - We now report policy setting usage via clientmetrics. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com> |
||
|---|---|---|
| .. | ||
| addlicense | ||
| build-webclient | ||
| cloner | ||
| connector-gen | ||
| containerboot | ||
| derper | ||
| derpprobe | ||
| dist | ||
| get-authkey | ||
| gitops-pusher | ||
| hello | ||
| k8s-nameserver | ||
| k8s-operator | ||
| mkmanifest | ||
| mkpkg | ||
| mkversion | ||
| nardump | ||
| natc | ||
| netlogfmt | ||
| nginx-auth | ||
| pgproxy | ||
| printdep | ||
| proxy-to-grafana | ||
| sniproxy | ||
| speedtest | ||
| ssh-auth-none-demo | ||
| stunc | ||
| stund | ||
| stunstamp | ||
| sync-containers | ||
| tailscale | ||
| tailscaled | ||
| testcontrol | ||
| testwrapper | ||
| tsconnect | ||
| tsidp | ||
| tsshd | ||
| viewer | ||
| xdpderper | ||