include unixsocketidentity feature (fixes CLI access denied)

The --extra-small baseline omits unixsocketidentity, but without it the localapi cannot verify a request came over the trusted unix socket, so PermitRead/PermitWrite are always false and every CLI call (status, up, set, ...) returns 'access denied' (tailscale/tailscale#17873). Add it to the opt-in allowlist. Negligible size cost (~3.55 MB unchanged); the CLI is non-functional without it.
2026-05-29 04:33:02 +02:00
parent e0cbaee48b
commit 7a6efb52ec
2 changed files with 7 additions and 0 deletions
@@ -127,6 +127,7 @@ that's a separate build, not just a `--platform` change.
 | health | Powers `tailscale status` output |
 | iptables | Linux iptables support for routing rules |
 | osrouter | Configure kernel network stack and routing tables |
+| unixsocketidentity | **Required** — without it the localapi denies every CLI call with "access denied" ([tailscale#17873](https://github.com/tailscale/tailscale/issues/17873)) |

 ## Features intentionally omitted