Connect: Make sure tsh auto-updates are turned off #49180
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ravicious
added
no-changelog
ravicious
requested review from
gzdunek
and removed request for
flyinghermit
ravicious
commented
Nov 19, 2024
There was a problem hiding this comment.
@gzdunek I added this folder so we can start sorting shared files. I imagine we'd also want to create a folder called "universal" for files that are used both in the browser and in Node.js.
ravicious
commented
Nov 19, 2024
| <!-- Auto-updates are disabled because $HOME isn't available, | ||
| but let's also disable them explicitly anyway. --> | ||
| <key>TELEPORT_TOOLS_VERSION</key> | ||
| <string>off</string> |
There was a problem hiding this comment.
The env vars available in the launch daemon process are just these:
TELEPORT_TOOLS_VERSION=off XPC_SERVICE_NAME=com.goteleport.tshdev.vnetd PATH=/usr/bin:/bin:/usr/sbin:/sbin XPC_FLAGS=1
avatus
approved these changes
Nov 19, 2024
gzdunek
approved these changes
Nov 19, 2024
|
@ravicious See the table below for backport results.
|
ravicious
added a commit
that referenced
this pull request
Nov 19, 2024
* Add dir for code shared between Node.js processes * Connect: Make sure tsh auto-updates are turned off * Pass TELEPORT_TOOLS_VERSION=off to tsh vnet-daemon
|
Backported to v16 and v15 here: |
github-merge-queue bot
pushed a commit
that referenced
this pull request
Dec 4, 2024
* Expose client tools auto update for find endpoint (#46785) * Expose client tools auto update for find endpoint * Group auto update settings in find response Log error instead returning error Add tests auto update settings in find endpoint Add check for not implemented error * Add more test cases * Client AutoUpdate proto structure changes (#47532) * Update client autoupdate proto structure * Replace with reserved * Fix unit tests * Add more info in proto * Rename proto to be aligned RFD namings * Replace enum type for ToolsMode to string * Add packaging utility for client tools auto updates (#47060) * Add packaging utility for client tools auto updates * Add error handling for close functions * Move archive to existing utils package * Move archive helpers to integration/helper CR changes * CR changes * CR changes * CR changes Replace creating directory with extract path as argument * CR changes * Validate full size before un-archive Extract files to extractDir with ignore dir structure * Change compressing with relative paths Add test for cleanup and fix skip logic * CR changes * CR changes * Fix linter * Client tools auto update (#47466) * Add client tools auto update * Replace fork for posix platform for re-exec Move integration tests to client tools specific dir Use context cancellation with SIGTERM, SIGINT Remove cancelable tee reader with context replacement Renaming * Fix syscall path execution Fix archive cleanup if hash is not valid Limit the archive write bytes * Cover the case with single package for darwin platform after v17 * Move updater logic to tools package * Move context out from the library Base URL renaming * Add more context in comments * Changes in find endpoint * Replace test http server with `httptest` Replace hash for bytes matching Proper temp file close for archive download * Add more context to comments * Move feature flag to main package to be reused * Constant rename * Replace build tag with lib/modules to identify enterprise build * Replace fips tag with modules flag * Client auto updates integration for {tctl,tsh} (#47815) * Client auto updates integration for tctl/tsh * Add version validation Fix recursive version check for darwin platform Fix cleanup for multi-package support * Fix identifying tools removal from home directory * Replace ToolsMode with ToolsAutoUpdate * Reuse insecure flag for tests * Fix CheckRemote with login * Fix windows administrative access requirement Update must be able to be canceled, re-execute with latest version or last updated Show progress bar before request is made * Fix update cancellation for login action Address review comments * Add signal handler with stack context cancellation * Use copy instead of hard link for windows Fix progress bar if we can't receive size of package * Replace with list in order to support manual cancel * Download archive package to temp directory * Decrease timeout for client tools proxy call * Add audit logs for auto update resources (#48218) * Connect: Make sure tsh auto-updates are turned off (#49180) * Add dir for code shared between Node.js processes * Connect: Make sure tsh auto-updates are turned off * Pass TELEPORT_TOOLS_VERSION=off to tsh vnet-daemon * Disable client tools auto update disabled if there are no home dir (#49159) Move updater to general tools package * Move client auto update helper to lib package (#49247) --------- Co-authored-by: Rafał Cieślak <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR makes it so that tsh never attempts to auto-update itself when it's executed by Connect, as described in RFD 144.
I think I haven't missed any place. I verified that this works by starting Connect, starting an SSH session and a local terminal and then running
ps eww <pid> | rg TELEPORTon the tsh daemon process and thetsh sshprocess. I also verified that the env var is present in the local terminal session.I also verified that the env var is set correctly on Windows in cmd.exe, pwsh.exe and wsl.exe and that the launch daemon receives the env var.