WIP: acl interceptor and named pipe ui

client/internal/profilemanager/config.go

@@ -102,6 +102,11 @@ type ConfigInput struct {
 	DNSLabels domain.List
 
 	MTU *uint16
+
+	// Owners replaces the profile's owner principal list when non-nil.
+	// Shared replaces the profile's shared flag when non-nil.
+	Owners []string
+	Shared *bool
 }
 
 // Config Configuration type
@@ -184,6 +189,17 @@ type Config struct {
 
 	MTU uint16
 
+	// Owners lists the principals allowed to control this profile over the local
+	// IPC, as typed strings: "uid:1000", "gid:1000", "group:netbird-admins"
+	// (Unix, NSS-resolved) or "sid:S-1-5-..." (Windows user or group SID). Empty
+	// with Shared=false means the profile is owned by nobody yet (privileged +
+	// daemon-self only, until claimed). Interpreted by client/internal/ipcauth.
+	Owners []string `json:"Owners,omitempty"`
+
+	// Shared, when true, lets any authenticated local caller control this profile
+	// (opt-in). Takes precedence over Owners.
+	Shared bool `json:"Shared,omitempty"`
+
 	// policy is the MDM policy that produced the currently-set values for
 	// any MDM-enforced fields. Set by applyMDMPolicy at the tail of apply()
 	// and reset on every apply() invocation. Never persisted to disk.
@@ -642,6 +658,18 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
+	if input.Owners != nil && !slices.Equal(config.Owners, input.Owners) {
+		log.Infof("updating profile owners to %v", input.Owners)
+		config.Owners = input.Owners
+		updated = true
+	}
+
+	if input.Shared != nil && *input.Shared != config.Shared {
+		log.Infof("updating profile shared flag to %t", *input.Shared)
+		config.Shared = *input.Shared
+		updated = true
+	}
+
 	// MDM is the last override layer: any key present in the policy
 	// supersedes defaults, on-disk config, env vars and CLI input.
 	config.applyMDMPolicy(loadMDMPolicy())

client/internal/profilemanager/service.go

@@ -296,7 +296,7 @@ func (s *ServiceManager) DefaultProfilePath() string {
 // The returned Profile carries the freshly-generated ID so callers can
 // show it to the user (and so the gRPC AddProfileResponse can include
 // it).
-func (s *ServiceManager) AddProfile(displayName, username string) (*Profile, error) {
+func (s *ServiceManager) AddProfile(displayName, username string, owners []string) (*Profile, error) {
 	configDir, err := s.getConfigDir(username)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get config directory: %w", err)
@@ -318,6 +318,9 @@ func (s *ServiceManager) AddProfile(displayName, username string) (*Profile, err
 		return nil, fmt.Errorf("failed to create new config: %w", err)
 	}
 	cfg.Name = displayName
+	// owners auto-isolates the new profile to its creator (nil = unowned, so the
+	// eventual first caller claims it via trust-on-first-use).
+	cfg.Owners = owners
 
 	if err := util.WriteJson(context.Background(), profPath, cfg); err != nil {
 		return nil, fmt.Errorf("failed to write profile config: %w", err)

client/internal/profilemanager/service_test.go

@@ -32,7 +32,7 @@ func withTestSM(t *testing.T, fn func(sm *ServiceManager, username string)) {
 
 func TestServiceProfile_ExactID(t *testing.T) {
 	withTestSM(t, func(sm *ServiceManager, username string) {
-		created, err := sm.AddProfile("work", username)
+		created, err := sm.AddProfile("work", username, nil)
 		require.NoError(t, err)
 
 		got, err := sm.ResolveProfile(created.ID.String(), username)
@@ -44,7 +44,7 @@ func TestServiceProfile_ExactID(t *testing.T) {
 
 func TestServiceProfile_IDPrefix(t *testing.T) {
 	withTestSM(t, func(sm *ServiceManager, username string) {
-		created, err := sm.AddProfile("work", username)
+		created, err := sm.AddProfile("work", username, nil)
 		require.NoError(t, err)
 
 		prefix := created.ID[:4]
@@ -75,7 +75,7 @@ func TestServiceProfile_AmbiguousPrefix(t *testing.T) {
 
 func TestServiceProfile_ExactNameUnique(t *testing.T) {
 	withTestSM(t, func(sm *ServiceManager, username string) {
-		_, err := sm.AddProfile("work", username)
+		_, err := sm.AddProfile("work", username, nil)
 		require.NoError(t, err)
 
 		got, err := sm.ResolveProfile("work", username)
@@ -86,9 +86,9 @@ func TestServiceProfile_ExactNameUnique(t *testing.T) {
 
 func TestServiceProfile_AmbiguousName(t *testing.T) {
 	withTestSM(t, func(sm *ServiceManager, username string) {
-		_, err := sm.AddProfile("work", username)
+		_, err := sm.AddProfile("work", username, nil)
 		require.NoError(t, err)
-		_, err = sm.AddProfile("work", username)
+		_, err = sm.AddProfile("work", username, nil)
 		require.NoError(t, err)
 
 		_, err = sm.ResolveProfile("work", username)
@@ -133,10 +133,10 @@ func TestServiceProfile_LegacyFilenameCoexists(t *testing.T) {
 
 func TestAddProfile_AllowsDuplicateWithFlag(t *testing.T) {
 	withTestSM(t, func(sm *ServiceManager, username string) {
-		first, err := sm.AddProfile("work", username)
+		first, err := sm.AddProfile("work", username, nil)
 		require.NoError(t, err)
 
-		second, err := sm.AddProfile("work", username)
+		second, err := sm.AddProfile("work", username, nil)
 		require.NoError(t, err)
 		assert.NotEqual(t, first.ID, second.ID)
 		assert.Equal(t, "work", second.Name)
@@ -151,7 +151,7 @@ func TestAddProfile_RejectsInvalidNames(t *testing.T) {
 			strings.Repeat("a", maxProfileNameLen+1), // too long
 		}
 		for _, name := range cases {
-			_, err := sm.AddProfile(name, username)
+			_, err := sm.AddProfile(name, username, nil)
 			assert.Error(t, err, "expected error for %q", name)
 		}
 	})
@@ -215,7 +215,7 @@ func TestIsValidProfileFilenameStem(t *testing.T) {
 
 func TestRemoveProfile_DeletesStateFile(t *testing.T) {
 	withTestSM(t, func(sm *ServiceManager, username string) {
-		created, err := sm.AddProfile("work", username)
+		created, err := sm.AddProfile("work", username, nil)
 		require.NoError(t, err)
 
 		configDir, err := sm.getConfigDir(username)