From 6f7e0409f8203c64d8037a77407a7ac02c70f6ce Mon Sep 17 00:00:00 2001
From: Viktor Liu <viktor@netbird.io>
Date: Wed, 9 Sep 2026 09:36:05 +0200
Subject: [PATCH] Document the daemon socket restriction in the macOS MDM
 manifests

---
 docs/io.netbird.client.plist    | 15 +++++++++++++++
 docs/netbird-macos.mobileconfig | 16 ++++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/docs/io.netbird.client.plist b/docs/io.netbird.client.plist
index eec96d35b..93536dd87 100644
--- a/docs/io.netbird.client.plist
+++ b/docs/io.netbird.client.plist
@@ -147,5 +147,20 @@
     <string>com.acme.app1,com.acme.app2</string>
     -->
 
+    <!-- ===== Daemon socket restriction =====
+         Restricts the daemon control socket, and the JSON socket where it is
+         enabled, to the listed principals. Accounts outside them cannot connect
+         at all. Overrides the install-time --allow-group in both directions; an
+         empty string lifts a restriction the install set.
+
+         Unix group IDs in gid:<id> form, comma-separated. Resolved IDs rather
+         than group names because the daemon reads this while starting and must
+         not wait on a directory service to resolve a name. A single group per
+         host: a Unix socket carries one owning group. -->
+    <!--
+    <key>allowGroups</key>
+    <string>gid:1001</string>
+    -->
+
 </dict>
 </plist>
diff --git a/docs/netbird-macos.mobileconfig b/docs/netbird-macos.mobileconfig
index 5d886c283..9ca127d46 100644
--- a/docs/netbird-macos.mobileconfig
+++ b/docs/netbird-macos.mobileconfig
@@ -165,6 +165,22 @@
                                 <false/>
                                 -->
 
+                                <!-- ===== Daemon socket restriction =====
+                                     Restricts the daemon control socket, and the JSON socket
+                                     where it is enabled, to the listed principals. Accounts
+                                     outside them cannot connect at all. Overrides the
+                                     install-time --allow-group in both directions; an empty
+                                     string lifts a restriction the install set.
+
+                                     Unix group IDs in gid:<id> form, comma-separated. Resolved
+                                     IDs rather than group names because the daemon reads this
+                                     while starting and must not wait on a directory service.
+                                     One group per host: a Unix socket carries one owning group. -->
+                                <!--
+                                <key>allowGroups</key>
+                                <string>gid:1001</string>
+                                -->
+
                             </dict>
                         </dict>
                     </array>