[v10] Add directory sharing to the ACL

lib/services/role.go

@@ -2098,8 +2098,8 @@ func (set RoleSet) DesktopClipboard() bool {
 }
 
 // DesktopDirectorySharing returns true if the role set has directory sharing
-// enabled. This setting is enabled if one or more of the roles in the set has
-// enabled it.
+// enabled. This setting is disabled if one or more of the roles in the set has
+// disabled it.
 func (set RoleSet) DesktopDirectorySharing() bool {
 	for _, role := range set {
 		if !types.BoolDefaultTrue(role.GetOptions().DesktopDirectorySharing) {

lib/srv/desktop/dir_sharing_disabled.go

@@ -19,6 +19,6 @@ limitations under the License.
 
 package desktop
 
-func allowDirectorySharing() bool {
+func AllowDirectorySharing() bool {
 	return false
 }

lib/srv/desktop/dir_sharing_enabled.go

@@ -19,6 +19,6 @@ limitations under the License.
 
 package desktop
 
-func allowDirectorySharing() bool {
+func AllowDirectorySharing() bool {
 	return true
 }

lib/srv/desktop/windows_server.go

@@ -844,8 +844,8 @@ func (s *WindowsService) connectRDP(ctx context.Context, log logrus.FieldLogger,
 		Conn:           tdpConn,
 		AuthorizeFn:    authorize,
 		AllowClipboard: authCtx.Checker.DesktopClipboard(),
-		// allowDirectorySharing() ensures this setting is modulated by build flag while in development
-		AllowDirectorySharing: authCtx.Checker.DesktopDirectorySharing() && allowDirectorySharing(),
+		// AllowDirectorySharing() ensures this setting is modulated by build flag while in development
+		AllowDirectorySharing: authCtx.Checker.DesktopDirectorySharing() && AllowDirectorySharing(),
 	})
 	if err != nil {
 		s.onSessionStart(ctx, sw, &identity, sessionStartTime, windowsUser, string(sessionID), desktop, err)

lib/web/ui/usercontext.go

@@ -22,6 +22,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/srv/desktop"
 )
 
 type access struct {
@@ -86,6 +87,8 @@ type userACL struct {
 	Clipboard bool `json:"clipboard"`
 	// DesktopSessionRecording defines whether the user's desktop sessions are being recorded.
 	DesktopSessionRecording bool `json:"desktopSessionRecording"`
+	// DirectorySharing defines whether a user is permitted to share a directory during windows desktop sessions.
+	DirectorySharing bool `json:"directorySharing"`
 }
 
 type authType string
@@ -203,6 +206,7 @@ func NewUserContext(user types.User, userRoles services.RoleSet, features proto.
 	windowsLogins := getWindowsDesktopLogins(userRoles)
 	clipboard := userRoles.DesktopClipboard()
 	desktopSessionRecording := desktopRecordingEnabled && userRoles.RecordDesktopSession()
+	directorySharing := userRoles.DesktopDirectorySharing()
 
 	acl := userACL{
 		AccessRequests:          requestAccess,
@@ -223,6 +227,8 @@ func NewUserContext(user types.User, userRoles services.RoleSet, features proto.
 		Billing:                 billingAccess,
 		Clipboard:               clipboard,
 		DesktopSessionRecording: desktopSessionRecording,
+		// AllowDirectorySharing() ensures this setting is modulated by build flag while in development
+		DirectorySharing: directorySharing && desktop.AllowDirectorySharing(),
 	}
 
 	// local user