mirror of
https://github.com/tailscale/tailscale.git
synced 2026-11-04 02:58:19 +09:00
James Tucker
1334899864
Monitor teardown SIGHUPed and SIGKILLed every remembered child group when the transport closed. sshd signals nothing at a non-PTY session end; background jobs with redirected stdio survive and reparent to init. Clients rely on that: VS Code Remote-SSH starts its remote server as a plain background job in the session's group and expects it to outlive connection drops, and tailscale upgrades run as non-PTY execs whose work should survive a daemon restart. Use an explicit graceful monitor close to preserve session jobs on ordinary disconnect and daemon shutdown. Close PTY masters normally, letting the terminal driver signal the foreground group, but do not signal non-PTY jobs. Remove Linux Pdeathsig from session children; forwarding children retain it and always die with the connection. Commit duration and recording-failure termination to the monitor before publishing cancellation or writing the termination message. The monitor owns per-session HUP-to-KILL escalation even after the leader exits or the connection closes. Revocation arms connection-wide cleanup. Pin every termination target's leader until after SIGKILL, including during teardown, so group signaling cannot hit reused PIDs. Select teardown targets explicitly and leave graceful survivors alone. Unexpected RPC loss fails closed. If a termination mandate cannot be delivered, close the RPC rather than subsequently requesting graceful teardown; this may also kill sibling jobs on a broken channel. Keep both the escalation and monitor shutdown waits bounded. Add coverage for default-HUP graceful survivors, actual duration and recording-failure termination followed by immediate disconnect, sibling survival, HUP-exiting leaders with immune group members, broken RPCs, and leader pinning through teardown's SIGKILL pass. Fixes #22076 Signed-off-by: James Tucker <james@tailscale.com> Change-Id: I70b4ef40035330dd542d256ba79d889a12426a74
53 lines
1.5 KiB
Go
53 lines
1.5 KiB
Go
// Copyright (c) Tailscale Inc & contributors
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
//go:build linux && !android
|
|
|
|
package tailssh
|
|
|
|
import (
|
|
"math"
|
|
"syscall"
|
|
|
|
"golang.org/x/sys/unix"
|
|
)
|
|
|
|
// monChildAttr returns process attributes for a session child.
|
|
// With ctty, the child starts a session with fd 0 as its controlling terminal.
|
|
// Otherwise it starts a process group.
|
|
// Pdeathsig is unset so the child can survive monitor exit.
|
|
func monChildAttr(ctty bool) *syscall.SysProcAttr {
|
|
return &syscall.SysProcAttr{
|
|
Setpgid: !ctty,
|
|
Setsid: ctty,
|
|
Setctty: ctty,
|
|
}
|
|
}
|
|
|
|
// scrubFds marks every open descriptor from 3 up close-on-exec, so the
|
|
// monitor cannot leak an inherited or late-created descriptor into a
|
|
// child it execs. close_range(CLOSE_RANGE_CLOEXEC) does this in one
|
|
// atomic syscall on kernels 5.11 and later; older kernels fall back to
|
|
// a /proc/self/fd enumeration.
|
|
func scrubFds() error {
|
|
if err := unix.CloseRange(3, math.MaxUint32, unix.CLOSE_RANGE_CLOEXEC); err == nil {
|
|
return nil
|
|
}
|
|
return scrubFdsByScan("/proc/self/fd")
|
|
}
|
|
|
|
// fwdChildAttr returns process attributes for a forwarding child.
|
|
// The child runs with ma's credentials in its own process group.
|
|
// Pdeathsig sends SIGHUP when the creating thread exits. See golang/go#27505.
|
|
func fwdChildAttr(ma monitorArgs) *syscall.SysProcAttr {
|
|
return &syscall.SysProcAttr{
|
|
Credential: &syscall.Credential{
|
|
Uid: ma.uid,
|
|
Gid: ma.gid,
|
|
Groups: fwdCredGroups(ma.gid, ma.gids),
|
|
},
|
|
Setpgid: true,
|
|
Pdeathsig: unix.SIGHUP,
|
|
}
|
|
}
|