Clean up windows impersonation/SDDL and some comments

client/cmd/root.go

@@ -144,8 +144,6 @@ func init() {
 
 	defaultDaemonAddr := "unix:///var/run/netbird.sock"
 	if runtime.GOOS == "windows" {
-		// Named pipe (not loopback TCP): the pipe client token carries the
-		// caller's SID so the daemon can authorize each RPC by caller identity.
 		defaultDaemonAddr = "npipe://netbird"
 	}
 

client/cmd/service_controller.go

@@ -22,19 +22,19 @@ import (
 )
 
 // daemonServerOptions installs peer-identity transport credentials and the
-// authorization interceptor on the daemon control channel. Identity is only
-// available over a Unix socket (SO_PEERCRED) or a Windows named pipe (client
-// token); over TCP, or on platforms without a peer-credential primitive, the
-// daemon runs without per-caller authorization and warns (no interceptor, so it
-// does not deny everyone).
+// authorization interceptor on the daemon ipc. Identity is only available
+// over a Unix socket (SO_PEERCRED) or a Windows named pipe (client token).
+// Over TCP, or on platforms without a peer-credential primitive, the daemon
+// runs without per-caller authorization and warns (no interceptor, so it does
+// not deny everyone).
 func daemonServerOptions(network string, interceptor *ipcauth.Interceptor) []grpc.ServerOption {
 	creds := ipcauth.NewTransportCredentials()
 	if creds == nil {
-		log.Warnf("daemon control channel has no peer-identity primitive on %s; per-caller authorization is disabled", runtime.GOOS)
+		log.Warnf("daemon ipc has no peer-identity primitive on %s, per-caller authorization is disabled", runtime.GOOS)
 		return nil
 	}
 	if network == "tcp" {
-		log.Warnf("daemon is listening on TCP (%s); peer identity cannot be authenticated over TCP, per-caller authorization is disabled", daemonAddr)
+		log.Warnf("daemon is listening on TCP (%s), peer identity cannot be authenticated over TCP, per-caller authorization is disabled", daemonAddr)
 		return nil
 	}
 	return []grpc.ServerOption{

client/cmd/service_pipe_windows.go

@@ -12,24 +12,22 @@ import (
 	"github.com/netbirdio/netbird/client/internal/ipcauth"
 )
 
-// listenNamedPipe creates the daemon control named pipe with a tight SDDL
-// (SYSTEM + Administrators + interactive users). ListenPipe fails if the pipe
-// already exists (first-instance semantics), which prevents a squatting process
-// from pre-creating it — we surface that error loudly rather than falling back.
+// listenNamedPipe creates the daemon control named pipe with a permissive,
+// local-only SDDL. Any local caller may connect, on par with the Unix
+// socket's 0666, and the per-RPC interceptor authorizes. ListenPipe fails
+// if the pipe already exists (first-instance semantics), which prevents a
+// squatting process from pre-creating it.
 func listenNamedPipe(path string) (net.Listener, error) {
 	return winio.ListenPipe(path, &winio.PipeConfig{
 		SecurityDescriptor: ipcauth.DefaultPipeSDDL(),
 	})
 }
 
-// dialNamedPipe connects to the daemon control named pipe at SECURITY_IDENTIFICATION.
-//
-// winio's plain DialPipe connects at SECURITY_ANONYMOUS, under which the daemon
-// cannot read the caller's token (ImpersonateNamedPipeClient fails / yields an
-// anonymous token and the handshake is dropped). Identification lets the daemon
-// *identify* the caller (read its SID/groups) without granting it the ability to
-// act as the caller — the least privilege the daemon needs for authorization.
+// dialNamedPipe connects to the daemon ipc named pipe at SECURITY_IDENTIFICATION.
 func dialNamedPipe(ctx context.Context, path string) (net.Conn, error) {
 	access := uint32(windows.GENERIC_READ | windows.GENERIC_WRITE)
+	// winio's plain DialPipe connects at SECURITY_ANONYMOUS, under which the
+	// daemon cannot read the caller's token. Identification lets the daemon
+	// read its SID/groups without granting it the ability to act as the caller.
 	return winio.DialPipeAccessImpLevel(ctx, path, access, winio.PipeImpLevelIdentification)
 }

client/cmd/service_socket.go

@@ -61,9 +61,8 @@ func parseListenAddress(addr string) (string, string, error) {
 	}
 }
 
-// pipePath maps a daemon-addr npipe name (e.g. "netbird" from "npipe://netbird")
-// to a Windows named-pipe path (\\.\pipe\netbird). A full \\.\pipe\ path is
-// returned unchanged.
+// pipePath maps a daemon-addr npipe name ("npipe://netbird") to a Windows
+// named-pipe path (\\.\pipe\netbird).
 func pipePath(name string) string {
 	if strings.HasPrefix(name, `\\`) {
 		return name