Luke Okraszewski
6dbccdd8ad
Linux: fix potential deadlock/segfault when calling into libnss for user mgmt ( #295 )
...
Export-Source-Commit: 12f28f2b1aa27c84df9f608557b8dc6f0de6cbb2
2026-08-25 11:35:10 -05:00
Russell Jones
e0d3c67924
Perf and stability improve for lib/srv/regular ( #64877 )
...
Parallelized and increased frequency of checks for many tests.
Stabilized the following tests.
* TestAllowedLabels
* TestDirectTCPIP
* TestLockInForce
* TestTCPIPForward
* TestAgentForward
* TestX11Forward
Original flaky behavior for the above tests can be reproduced using
[stress](https://pkg.go.dev/golang.org/x/tools/cmd/stress ) with the
following command:
```
go test -o flaky.test ./... && \
stress -p 30 -failfast ./flaky.test -test.run="TestName"
```
The following tests still show up when running the full test suite for
`lib/srv/regular` under `stress`.
* TestMultipleExecCommands
* TestSessionAuditLog
2026-08-08 01:03:32 +00:00
Andrew LeFevre
d664e77758
mask setuid/setgid/sticky bits when transferring files via SFTP ( #67784 )
...
* mask setuid/setgid/sticky bits when transferring files via SFTP
* use correct ordering when creating hardlinks and symlinks
2026-08-05 20:13:41 +00:00
Andrew LeFevre
458469d859
set supplemental groups and reject symlinks when reading .tsh/environment file ( #67779 )
...
* set supplemental groups and reject symlinks when reading .tsh/environment file
* moved safefile out of internal
2026-08-05 19:12:27 +00:00
cf91ada533
Add Linux desktop support ( #65841 )
...
* Implement support for TDPB in Desktop Agent.
* Add LinuxDesktop gRPC and backend
* Add LinuxDesktop resource to unified resources
* Add Linux desktop service
* Remove CloneResource
* Review comments
* Unifide fix
* routing
* Fix logins
* Fix logins
* Fix CA cache and write basic loop
* Review comment
* Fix components and handleConnection
* Review comment
* Add ClonableResourceWithLabels
* Fix missing CloneResource
* Add Xvfb handlers
* Add Xephyr
* Add Xvfb controller
* Add QOI encoder
* encoder + xsession
* reexec
* ChildLogConfig
* session
* add forceloginshell
* update frontend + fix session
* Review comments
* Fix code, update docs
* Fix TARGETS format, reuse waiting
* Remove direct mode
* Update lib/auth/linuxdesktop/linuxdesktopv1/service.go
Co-authored-by: Zac Bergquist <[email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
2026-07-09 07:41:47 +00:00
Maja Cieślak
4f97883437
Add TestLoginShell to avoid lib/web tests polluting shell history ( #67594 )
...
* Add `TestLoginShell` to avoid lib/web tests polluting shell history
* Use `go:embed` to avoid problems with cwd
* Add regression test to make sure `noHistoryShell` works
* Remove unnecessary comment
2026-06-18 14:57:48 +00:00
Andrew LeFevre
f62ceb241c
return an error when an absolute path isn't specified in a moderated upload, or if the path is a dir ( #67346 )
...
* return an error when an absolute path isn't specified in a moderated upload, or if the path is a dir
* don't show the filename to moderators
* revert change to comment
2026-06-05 18:54:34 +00:00
Andrew LeFevre
ce12c7736f
handle failing to load PAM getenvlist symbol correctly ( #67477 )
2026-06-04 18:24:30 +00:00
Edoardo Spadolini
5c1c9d157d
Disable the embedded session helper by default ( #67386 )
2026-06-03 09:56:48 +00:00
Andrew Burke
5b51177841
Block symlinks and relative paths for moderated file transfers ( #65674 )
...
This change updates moderated file transfers to not allow symlink
traversal or relative paths.
2026-05-14 20:40:14 +00:00
Brian Joerger
6e40940512
Capture reexec networking stderr for logging ( #65202 )
...
* Capture reexec networking stderr and propagate it to the client.
* Move process closure higher in the callstack when waitReady fails.
* Add test for waitReady.
* Add t.Context() select case.
* Address comments.
* Resolve comments.
* Have callers provide context.
* Address comments.
* Fix merge conflicts.
* Fix typo.
* Fix test.
* Fix merge conflicts.
* Fix edge case with unbounded stderr.
* Fix lint.
2026-04-29 20:04:39 +00:00
Przemko Robakowski and Edoardo Spadolini
a13ff87916
Refactor command reexecution ( #65562 )
...
* Refactor command reexecution
* Review comments
* Review comments
* Document context
* Update lib/srv/bpf_test.go
Co-authored-by: Edoardo Spadolini <[email protected] [email protected] [email protected] [email protected] [email protected]
2026-04-28 20:38:46 +00:00
Edoardo Spadolini
b98921dff8
session-helper: Build changes ( #66003 )
...
* Build and test changes for sessionhelper
* Always print text in check-session-helper
* Fix TwoClustersTunnel
2026-04-24 10:07:18 +00:00
Edoardo Spadolini
3da0f44c80
session-helper: embeddable binary and embedding logic ( #65784 )
...
* Clean up unneeded forwarder for reexec.IsReexec
* Disallow reexec through common.Run
* Remove the checkhomedir SSH subsystem
* Add true reexec subcommand
* Assume /proc/self/exe is always usable
* Add sessionhelper embed logic
2026-04-17 14:16:53 +00:00
Edoardo Spadolini
bcffdcbfd6
session-helper: move the sftp subcommand to reexec.RunAndExit ( #65392 )
...
* Split the approver map away from FileTransferRequest
* Move or copy files in session/reexec/sftputils and session/reexec/reexecsftp
* Split up copied files and clean up the new session packages
* Use custom types for SFTP audit log events
* Clean up imports and run sftp in RunAndExit
* Finish renaming types and functions
* Streamline reexec in main and tests
* Add test with the legacy SFTP event implementation
2026-04-15 13:28:27 +00:00
Edoardo Spadolini
825b23049e
session-helper: move srv.RunAndExit to session/reexec ( #65263 )
...
* Move the reexec parts of lib/srv to session/reexec
* Update references to the moved bits of lib/srv
* Avoid testutils in session/reexec
* Shuffle some constants around to avoid imports in session/reexec
* Vendor in the relevant parts of logutils in session/reexec
* Remove unnecessary symlink checks when opening files
* Inline the last two things from lib/utils in session/reexec
* Inline moved constants
* Deprecate group name consts and fix missed inlines
* Add missing session/reexec.TestMain with reexec check
* Reuse existing constants from the log constants package in session
* Fix broken godoc link
2026-04-08 09:40:52 +00:00
Luke Okraszewski