The TTY allocated for interactive sessions was not being handled
properly. The parent process was never closing its half of the
TTY, which prevented the PTY read from unblocking when the child
process terminated. This became more noticeable after #45223
landed because interactive sessions were now properly waiting for
the PTY copying to be completed before exiting.
Additionally, the PTY is no longer being provided to the child reexec
process since it should be only be used by the parent process.
Closes#45878.
* Add networking subprocess for port and agent forwarding.
* Remove extraneous x11 forwarding logic.
* Add x11 forwarding to the networking subprocess.
* Fix lint.
* Try create host user before starting networking process.
* Resolve comments
* Fix networking process memory leak.
* Run networking subprocess as root but change to user login after PAM call.
* Update agent forwarding socket dir permissions.
* Handle networking requests synchronously to maintain the current PAM context.
* Use user environment in networking process.
* Fix issue with PAM thread state being locked to the main goroutine; Clean up homeDir logic; Fix PAM thread state for xauth commands.
* Selectively handle some networking requests in goroutines.
* Address comments.
* Use an interrupt signal to trigger graceful exit in the networking subprocess.
* Cleanup unix sockets from the child namespace.
* Address comments.
* Remove extraneous network forwarding socket validation.
* Fix tests and lint.
* Re-add networking process done channel to avoid deadlocks on reading unix sockets passed to a dead process.
* Remove broken test.
* Address comments.
* Cleanup; remove unused child error file.
* - Explicility list file paths to clean up at the end of the networking process.
- Use terminate FD instead of interrupt to signal the process to exit.
- Log errors from the parent process.
- Read networking request response without goroutine.
* Cleanup.
* Make request socket a stream.
* Remove extraneious Chmod.
* Send request level error to request conn.
* Don't unlink unix sockets from the parent process.
* Read full error message from stream.
* Remove remaining logs in child process.
* Fix typos.
* web: support SAML resource deletion in unified resources view (#44311)
* update SAML app edit mechanism to accomodate both edit and delete functions
* use user saml idp access to disable menu actions
* add comment to ResourceActionButton props
* refactor: SamlAppActionContext to edit and delete Saml application
* address review comments
* Add networking process tests to replace old tests.
* Don't close remote file descriptor before the child process has a chance to connect to it.
* Fix lint; skip broken test.
* Disable broken test and restore older test to cover for it.
* Remove unused agent forwarding test.
* Fix lint, replace broken test.
* Fix old test that used testify/require in goroutine.
* Close request context immediately to avoid deadlock (extended timeout) on reading from the closed process.
---------
Co-authored-by: Sakshyam Shah <sshah@goteleport.com>
This change fixes a bug where remote port forwarding would fail if
the local login the user is SSHing with doesn't match the local user
running the node.
* Better control on user injected environment values
This commit includes two changes:
* In `environment` we expanded the list of MacOS environment values which should be filtered. It was demonstrated that these can be used to get code execution in MacOS.
* In `reexec` we no longer provide the cmdmsg.Environment for the `teleport exec`. As part of the development of a9055bccd9 it was attempted to fully clear out the environment, but testing showed that to be potentially problematic. It was believed the safest option was to use the cmd environment, however this introduces a new source of environment variables. Because this exec happens under `root` this is particularly dangerous (even more so when combined with the missed OSX values mentioned above). As such we now are only providing the filtered exec environment, which is a closer (but safer) option to the functionality prior to a9055bccd9.
* Update filter to exclude all DYLD_ and LD_ prefixed variables
The reexec process now has a two way wait mechanism to allow the
child process to complete any setup operations that may be required
before the parent process starts enhanced recording.
The old process was:
1) Parent launches child process
2) Child process opens PAM context and blocks on the continue signal
3) Parent sets up enhanced recording
4) Parent sends the continue signal
5) Child executes command/opens shell
The new process is:
1) Parent launches child process and waits for child continue signal
2) Child process opens PAM context and then signals it has completed setup
3) Parent receives child continue signal and sets up enhanced recording
4) Parent sends the continue signal
5) Child executes command/opens shell
Closes#29030
When a client sends an SSH session before the shell process ends, Teleport sends the SIGKILL signal to the subprocess. This causes the still-leaving shell to be resigned to PID 1 and live forever.
This PR tried to stop the terminal first before killing the subprocess to prevent the terminal from living forever.
Closes#13335Closes#6245Closes#4469
Invert the relationship of `lib/srv` and `lib/bpf`,
`lib/restrictedsession` such that `lib/bpf` is only imported in
`lib/srv/regular`. Since not everything is built with the `bpf`
tag it's important to reduce the surface area of `lib/bpf` such
that it isn't inadvertantly imported. For instance it was entirely
possible to import a package in `tsh` that transitively
depends on `lib/bpf` - which breaks the build since `tsh` is not
compiled with the `bpf` tag.
By refactoring the `srv.Server` interface not to use the `bpf.BPF`
and `restrictedsession.Manager` interfaces directly anything that
imports `lib/srv` now won't require that `-tags=bpf` is set in
order to compile.
Zac Bergquist