macOS: adjust DNS via both /etc/resolv.conf and system resolver

[josharian]

Customer bug report, not yet reproduced.

MagicDNS on macOS teaches the system resolver about Tailscale DNS entries. It does not modify /etc/resolv.conf.

Some macOS applications read /etc/resolv.conf for DNS instead of consulting the system resolver. Perhaps most notably, this includes Go applications build with cgo disabled, which means it affects docker, kubernetes, etc.

MagicDNS should probably adjust /etc/resolv.conf too.

This should probably block MagicDNS coming out of beta on macOS.

[bradfitz]

Do we even have the ability to do that from within the Network Extension App Store sandbox?

Might be an argument in favor of going the System Extension route instead (#718)

/cc @crawshaw

[crawshaw]

What macos apps read resolv.conf?

#
# macOS Notice
#
# This file is not consulted for DNS hostname resolution, address
# resolution, or the DNS query routing mechanism used by most
# processes on this system.
#
# To view the DNS configuration used by this system, use:
#   scutil --dns
#
# SEE ALSO
#   dns-sd(1), scutil(8)
#
# This file is automatically generated.
#
search localdomain
nameserver 192.168.1.1

We certainly cannot edit it from inside the sandbox.

[josharian]

What macos apps read resolv.conf?

Go applications build with cgo disabled, which means it affects docker, kubernetes, etc.

Relevant upstream issues:

golang/go#12524
golang/go#16345

[crawshaw]

This is fixed in Big Sur, our NetworkExtension automatically updates /etc/resolv.conf with no changes from us.