Let an MDM policy set the groups the daemon sockets are restricted to

client/cmd/service_allow_group.go

@@ -6,6 +6,8 @@ import (
 	"fmt"
 	"slices"
 	"strings"
+
+	"github.com/netbirdio/netbird/client/mdm"
 )
 
 // Principal kinds an --allow-group value resolves to. The kind:value form is
@@ -17,27 +19,33 @@ const (
 	allowGroupKindSID = "sid"
 )
 
-// resolveAllowGroups turns the values given on --allow-group into the typed
-// principals the daemon enforces on its sockets, dropping empty entries and
-// duplicates. Names are resolved through the platform's directory service, so
-// an entry that does not resolve is an error: a restriction the daemon cannot
-// evaluate must not become one that admits everybody. Values already in
-// kind:value form are validated and passed through, which is the form an
-// installed service hands to `service run`.
+// resolveAllowGroups turns configured group values into the typed principals
+// the daemon enforces on its sockets, dropping empty entries and duplicates.
+// Names are resolved through the platform's directory service, so an entry that
+// does not resolve is an error: a restriction the daemon cannot evaluate must
+// not become one that admits everybody. Values already in kind:value form are
+// validated and passed through, which is the form an installed service hands to
+// `service run`.
+//
+// Each value is split on commas, so one managed-configuration string listing
+// several principals behaves like the repeated flag. Neither a Unix group name
+// nor a Windows account name may contain a comma, so nothing is lost by it.
 func resolveAllowGroups(values []string) ([]string, error) {
 	var resolved []string
 	for _, value := range values {
-		value = strings.TrimSpace(value)
-		if value == "" {
-			continue
-		}
+		for _, entry := range strings.Split(value, ",") {
+			entry = strings.TrimSpace(entry)
+			if entry == "" {
+				continue
+			}
 
-		principal, err := resolveAllowGroup(value)
-		if err != nil {
-			return nil, fmt.Errorf("resolve --allow-group %q: %w", value, err)
-		}
-		if !slices.Contains(resolved, principal) {
-			resolved = append(resolved, principal)
+			principal, err := resolveAllowGroup(entry)
+			if err != nil {
+				return nil, fmt.Errorf("resolve allowed group %q: %w", entry, err)
+			}
+			if !slices.Contains(resolved, principal) {
+				resolved = append(resolved, principal)
+			}
 		}
 	}
 
@@ -47,6 +55,30 @@ func resolveAllowGroups(values []string) ([]string, error) {
 	return resolved, nil
 }
 
+// daemonSocketPrincipals returns the principals the daemon restricts its
+// sockets to, and the configuration that asked for them. An MDM policy
+// overrides the install-time --allow-group in both directions, as the other
+// MDM-overridable service flags do: a managed host can be restricted without a
+// reinstall, and a managed empty value lifts a restriction the install set.
+//
+// A configured value that cannot be resolved is an error rather than an
+// unrestricted socket. The daemon then does not serve at all, which is loud
+// enough for an administrator to find and correct, where a silently ignored
+// restriction would leave every local account reaching the daemon on a host
+// meant to be locked down.
+func daemonSocketPrincipals(policy *mdm.Policy) ([]string, string, error) {
+	values, source := allowGroups, "--allow-group"
+	if managed, ok := policy.GetStringSlice(mdm.KeyAllowGroups); ok {
+		values, source = managed, "MDM policy "+mdm.KeyAllowGroups
+	}
+
+	resolved, err := resolveAllowGroups(values)
+	if err != nil {
+		return nil, source, fmt.Errorf("%s: %w", source, err)
+	}
+	return resolved, source, nil
+}
+
 // cutKind splits a value on the kind separator. ok is false when the value
 // carries no kind, which is the case for a plain group or account name: neither
 // a Unix group name nor a Windows account name may contain a colon, so the