sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-24 06:19:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

Document the daemon socket restriction in the macOS MDM manifests

Browse Source
This commit is contained in:
Viktor Liu
2026-09-09 09:36:05 +02:00
parent 9a24fbe95f
commit 6f7e0409f8
2 changed files with 31 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/io.netbird.client.plist
+15
View File
@@ -147,5 +147,20 @@
<string>com.acme.app1,com.acme.app2</string> <string>com.acme.app1,com.acme.app2</string>
--> -->
<!-- ===== Daemon socket restriction =====
Restricts the daemon control socket, and the JSON socket where it is
enabled, to the listed principals. Accounts outside them cannot connect
at all. Overrides the install-time --allow-group in both directions; an
empty string lifts a restriction the install set.
Unix group IDs in gid:<id> form, comma-separated. Resolved IDs rather
than group names because the daemon reads this while starting and must
not wait on a directory service to resolve a name. A single group per
host: a Unix socket carries one owning group. -->
<!--
<key>allowGroups</key>
<string>gid:1001</string>
-->
</dict> </dict>
</plist> </plist>
docs/netbird-macos.mobileconfig
+16
View File
@@ -165,6 +165,22 @@
<false/> <false/>
--> -->
<!-- ===== Daemon socket restriction =====
Restricts the daemon control socket, and the JSON socket
where it is enabled, to the listed principals. Accounts
outside them cannot connect at all. Overrides the
install-time --allow-group in both directions; an empty
string lifts a restriction the install set.
Unix group IDs in gid:<id> form, comma-separated. Resolved
IDs rather than group names because the daemon reads this
while starting and must not wait on a directory service.
One group per host: a Unix socket carries one owning group. -->
<!--
<key>allowGroups</key>
<string>gid:1001</string>
-->
</dict> </dict>
</dict> </dict>
</array> </array>