Kristoffer Dalby 0e63f33863 ssh/tailssh: run su commands with --session-command, not -c ...

su -c runs the command in a new session: setsid means the user's shell
leaves the incubator's process group, so terminateSession's kill(-pgid)
never reaches it and session teardown signals nothing. Measured in
ubuntu:noble, su -l user -c 'ps -o pid,pgid,sid':

  -c                 pid 8  pgid 8  sid 8   <- own session
  --session-command  pid 13 pgid 1  sid 1   <- stays in ours

--session-command is util-linux-specific and BusyBox rejects it, so
findSU probes for it and falls back to -c. An su without it keeps the
old behavior rather than losing su support: teardown reaches only the
incubator there, as before.

findSU now returns the flag alongside the path, so the probe that
already ran to check -l support covers this too and no extra su
invocation is added. Verified in docker: TestIntegrationSIGHUP passes on
ubuntu:noble (was failing, 11s timeout) and still passes on
alpine:latest, where both probes fail and su is skipped entirely.

Updates #18256

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

2026-07-27 13:18:55 +00:00

..

tailssh

ssh/tailssh: run su commands with --session-command, not -c

2026-07-27 13:18:55 +00:00