Add an optional --allow-group flag restricting the daemon sockets (#7478)

docs/io.netbird.client.plist

@@ -147,5 +147,22 @@
     <string>com.acme.app1,com.acme.app2</string>
     -->
 
+    <!-- ===== Daemon socket restriction =====
+         Restricts the daemon control socket, and the JSON socket where it is
+         enabled, to the listed principals. Accounts outside them cannot connect
+         at all. Overrides the install-time allow-group flag in both directions;
+         an empty string lifts a restriction the install-time flag set.
+
+         Exactly one Unix group ID, in gid:<id> form. A Unix socket carries one
+         owning group, so a second entry is refused and the daemon does not
+         serve. The comma-separated form is for Windows accounts and SIDs only.
+
+         A resolved ID rather than a group name, because the daemon reads this
+         while starting and must not wait on a directory service. -->
+    <!--
+    <key>allowGroups</key>
+    <string>gid:1001</string>
+    -->
+
 </dict>
 </plist>

docs/netbird-macos.mobileconfig

@@ -165,6 +165,26 @@
                                 <false/>
                                 -->
 
+                                <!-- ===== Daemon socket restriction =====
+                                     Restricts the daemon control socket, and the JSON socket
+                                     where it is enabled, to the listed principals. Accounts
+                                     outside them cannot connect at all. Overrides the
+                                     install-time allow-group flag in both directions; an empty
+                                     string lifts a restriction the install-time flag set.
+
+                                     Exactly one Unix group ID, in gid:<id> form. A Unix socket
+                                     carries one owning group, so a second entry is refused and
+                                     the daemon does not serve. The comma-separated form is for
+                                     Windows accounts and SIDs only.
+
+                                     A resolved ID rather than a group name, because the daemon
+                                     reads this while starting and must not wait on a directory
+                                     service. -->
+                                <!--
+                                <key>allowGroups</key>
+                                <string>gid:1001</string>
+                                -->
+
                             </dict>
                         </dict>
                     </array>

docs/netbird.adml

@@ -56,6 +56,8 @@
 
       <string id="SplitTunnel_Name">Split tunnel</string>
       <string id="SplitTunnel_Help">Restrict the NetBird tunnel to or from a chosen list of application package names. Choose either the allow mode (only the listed apps route through NetBird) or the disallow mode (the listed apps bypass NetBird; everything else routes through). The mode is mutually exclusive — only one can be active at a time. Android-only at the daemon level; Windows/macOS/iOS clients ignore this policy.</string>
+      <string id="AllowGroups_Name">Restrict the daemon sockets</string>
+      <string id="AllowGroups_Help">Restrict the NetBird daemon control pipe, and the JSON socket where it is enabled, to the listed principals. Accounts outside them cannot connect at all, so nothing the daemon exposes is reachable from them; LocalSystem and elevated administrators are never locked out. Enter security identifiers in sid:S-1-5-21-... form, comma-separated, because the daemon reads this while starting and must not wait on a domain controller to resolve a name. An empty value lifts a restriction that was set when the service was installed.</string>
       <string id="SplitTunnel_Allow">Allow only listed apps (everything else bypasses)</string>
       <string id="SplitTunnel_Disallow">Disallow listed apps (everything else routes)</string>
 
@@ -101,6 +103,12 @@
         <decimalTextBox refId="WireguardPort_Decimal" defaultValue="51820">WireGuard UDP port:</decimalTextBox>
       </presentation>
 
+      <presentation id="AllowGroups_Pres">
+        <textBox refId="AllowGroups_Text">
+          <label>Allowed SIDs (comma-separated):</label>
+        </textBox>
+      </presentation>
+
       <presentation id="SplitTunnel_Pres">
         <dropdownList refId="SplitTunnel_Mode" defaultItem="0">Mode:</dropdownList>
         <textBox refId="SplitTunnel_Apps">

docs/netbird.admx

@@ -204,6 +204,19 @@
       </elements>
     </policy>
 
+    <policy name="AllowGroups"
+            class="Machine"
+            displayName="$(string.AllowGroups_Name)"
+            explainText="$(string.AllowGroups_Help)"
+            key="Software\Policies\NetBird"
+            presentation="$(presentation.AllowGroups_Pres)">
+      <parentCategory ref="NetBird" />
+      <supportedOn ref="SUPPORTED_NetBird_All" />
+      <elements>
+        <text id="AllowGroups_Text" valueName="AllowGroups" required="false" />
+      </elements>
+    </policy>
+
     <!-- ============================================================ -->
     <!-- UI: visibility / UX kill switches                             -->
     <!-- ============================================================ -->