On Windows, we already track the Windows userid who currently "owns" the backends.
On Linux/Unix we don't. We know the uid of the client's unix socket via https://inet.af/peercred but we require root for many actions.
But sudo sets some environment variables when run:
SUDO_UID Set to the user ID of the user who invoked sudo.
SUDO_USER Set to the login name of the user who invoked sudo.
So we could require sudo for tailscale up and then snapshot that SUDO_UID and let that userid do all commands in the future without sudo but otherwise require root the same as we do today.
/cc @danderson
On Windows, we already track the Windows userid who currently "owns" the backends.
On Linux/Unix we don't. We know the uid of the client's unix socket via https://inet.af/peercred but we require root for many actions.
But sudo sets some environment variables when run:
So we could require sudo for
tailscale upand then snapshot thatSUDO_UIDand let that userid do all commands in the future without sudo but otherwise require root the same as we do today./cc @danderson