mirror of
https://github.com/tailscale/tailscale.git
synced 2025-04-18 20:51:45 +00:00
cab0e1a6f7
This updates the syspolicy package to support multiple policy sources in the three policy scopes: user, profile, and device, and provides a merged resultant policy. A policy source is a syspolicy/source.Store that has a name and provides access to policy settings for a given scope. It can be registered with syspolicy/rsop.RegisterStore. Policy sources and policy stores can be either platform-specific or platform-agnostic. On Windows, we have the Registry-based, platform-specific policy store implemented as syspolicy/source.PlatformPolicyStore. This store provides access to the Group Policy and MDM policy settings stored in the Registry. On other platforms, we currently provide a wrapper that converts a syspolicy.Handler into a syspolicy/source.Store. However, we should update them in follow-up PRs. An example of a platform-agnostic policy store would be a policy deployed from the control, a local policy config file, or even environment variables. We maintain the current, most recent version of the resultant policy for each scope in an rsop.Policy. This is done by reading and merging the policy settings from the registered stores the first time the resultant policy is requested, then re-reading and re-merging them if a store implements the source.Changeable interface and reports a policy change. Policy change notifications are debounced to avoid re-reading policy settings multiple times if there are several changes within a short period. The rsop.Policy can notify clients if the resultant policy has changed. However, we do not currently expose this via the syspolicy package and plan to do so differently along with a struct-based policy hierarchy in the next PR. To facilitate this, all policy settings should be registered with the setting.Register function. The syspolicy package does this automatically for all policy settings defined in policy_keys.go. The new functionality is available through the existing syspolicy.Read* set of functions. However, we plan to expose it via a struct-based policy hierarchy, along with policy change notifications that other subsystems can use, in the next PR. We also plan to send the resultant policy back from tailscaled to the clients via the LocalAPI. This is primarily a foundational PR to facilitate future changes, but the immediate observable changes on Windows include: - The service will use the current policy setting values instead of those read at OS boot time. - The GUI has access to policy settings configured on a per-user basis. On Android: - We now report policy setting usage via clientmetrics. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>
48 lines
1.5 KiB
Go
48 lines
1.5 KiB
Go
// Copyright (c) Tailscale Inc & AUTHORS
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
package setting
|
|
|
|
// RawItem contains a raw policy setting as read from a policy store, or an
|
|
// error if the requested setting could not be read from the store. As a special
|
|
// case, it may also hold a value of the [Visibility], [PreferenceOption],
|
|
// or [time.Duration] types. While the policy store interface does not support
|
|
// these types natively, and the values of these types have to be unmarshalled
|
|
// or converted from strings, these setting types predate the typed policy
|
|
// hierarchies, and must be supported at this layer.
|
|
type RawItem struct {
|
|
value any
|
|
err *Error
|
|
origin *Origin // or nil
|
|
}
|
|
|
|
// RawItemOf returns [RawItem] with the specified value.
|
|
func RawItemOf(value any) RawItem {
|
|
return RawItemWith(value, nil, nil)
|
|
}
|
|
|
|
// RawItemWith returns an [RawItem] with the specified value, error and origin.
|
|
func RawItemWith(value any, err *Error, origin *Origin) RawItem {
|
|
return RawItem{value, err, origin}
|
|
}
|
|
|
|
// Value returns the value of an untyped policy setting,
|
|
// or nil if the policy setting is not configured.
|
|
func (i RawItem) Value() any {
|
|
return i.value
|
|
}
|
|
|
|
// Error returns the error that occurred when reading the policy setting,
|
|
// or nil if no error occurred.
|
|
func (i RawItem) Error() error {
|
|
if i.err != nil {
|
|
return i.err
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// Origin returns an optional [Origin] indicating the policy settings is configured.
|
|
func (i RawItem) Origin() *Origin {
|
|
return i.origin
|
|
}
|