Authorize daemon IPC callers by their local identity

client/ui/services/errors.go

@@ -6,13 +6,30 @@ import (
 	"encoding/json"
 	"strings"
 
+	"google.golang.org/genproto/googleapis/rpc/errdetails"
 	gcodes "google.golang.org/grpc/codes"
 	gstatus "google.golang.org/grpc/status"
 
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
 	"github.com/netbirdio/netbird/client/ui/i18n"
 	"github.com/netbirdio/netbird/client/ui/preferences"
 )
 
+// privilegeErrorInfo returns the daemon's privilege-refusal detail, if the error
+// carries one.
+func privilegeErrorInfo(err error) (*errdetails.ErrorInfo, bool) {
+	for _, detail := range gstatus.Convert(err).Details() {
+		info, ok := detail.(*errdetails.ErrorInfo)
+		if !ok {
+			continue
+		}
+		if info.GetReason() == ipcauth.ErrorReasonPrivilegeRequired && info.GetDomain() == ipcauth.ErrorDomain {
+			return info, true
+		}
+	}
+	return nil, false
+}
+
 // ErrorTranslator localises daemon errors; runtime impl is *i18n.Bundle.
 type ErrorTranslator interface {
 	Translate(lang i18n.LanguageCode, key string, args ...string) string
@@ -30,6 +47,10 @@ type ClientError struct {
 	Code  string `json:"code"`
 	Short string `json:"short"`
 	Long  string `json:"long"`
+	// Command is a command the user can run to complete the operation
+	// themselves, set when the daemon refused it for want of privileges. The
+	// frontend offers it for copying.
+	Command string `json:"command,omitempty"`
 }
 
 // Error returns the short message for plain Go callers.
@@ -72,6 +93,24 @@ func (c errorClassifier) classify(err error) *ClientError {
 		msg = st.Message()
 		grpcCode = st.Code()
 	}
+
+	// A refusal for want of privileges carries its own summary and the command
+	// that performs the operation, both written for the user. Surface them
+	// verbatim: no substring guessing, and no localisation of a message the
+	// daemon composed.
+	if info, ok := privilegeErrorInfo(err); ok {
+		summary := info.GetMetadata()[ipcauth.ErrorMetaSummary]
+		if summary == "" {
+			summary = msg
+		}
+		return &ClientError{
+			Code:    "privilege_required",
+			Short:   summary,
+			Long:    summary,
+			Command: info.GetMetadata()[ipcauth.ErrorMetaCommand],
+		}
+	}
+
 	lower := strings.ToLower(msg)
 
 	code := "unknown"

client/ui/services/settings.go

@@ -7,6 +7,10 @@ import (
 	"fmt"
 	"reflect"
 
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/daemonaddr"
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
 	"github.com/netbirdio/netbird/client/proto"
 )
 
@@ -39,6 +43,19 @@ type Restrictions struct {
 	Features Features  `json:"features"`
 }
 
+// Privilege tells the frontend whether this process may perform the changes the
+// daemon restricts to root/administrator, and carries the command for each so a
+// disabled control can show the way to do it.
+type Privilege struct {
+	Privileged bool `json:"privileged"`
+	// Actor names what the operation requires ("root", "administrator privileges").
+	Actor string `json:"actor"`
+	// Commands equivalent to the settings the daemon guards, ready to copy.
+	AllowSSHServer string `json:"allowSshServer"`
+	EnableSSHRoot  string `json:"enableSshRoot"`
+	DisableSSHAuth string `json:"disableSshAuth"`
+}
+
 type ConfigParams struct {
 	ProfileName string `json:"profileName"`
 	Username    string `json:"username"`
@@ -106,11 +123,19 @@ type SetConfigParams struct {
 }
 
 type Settings struct {
-	conn DaemonConn
+	conn       DaemonConn
+	classifier errorClassifier
+	// daemonAddr is where the daemon listens, used to tell whether it runs as
+	// this user and would therefore authorize us: see Privilege.
+	daemonAddr string
 }
 
-func NewSettings(conn DaemonConn) *Settings {
-	return &Settings{conn: conn}
+func NewSettings(conn DaemonConn, translator ErrorTranslator, prefs LanguagePreference, daemonAddr string) *Settings {
+	return &Settings{
+		conn:       conn,
+		classifier: errorClassifier{translator: translator, prefs: prefs},
+		daemonAddr: daemonAddr,
+	}
 }
 
 func (s *Settings) GetConfig(ctx context.Context, p ConfigParams) (Config, error) {
@@ -189,8 +214,47 @@ func (s *Settings) SetConfig(ctx context.Context, p SetConfigParams) error {
 		DisableSSHAuth:                p.DisableSSHAuth,
 		SshJWTCacheTTL:                p.SSHJWTCacheTTL,
 	}
-	_, err = cli.SetConfig(ctx, req)
-	return err
+	if _, err := cli.SetConfig(ctx, req); err != nil {
+		// Classified so the frontend gets the daemon's guidance instead of the
+		// gRPC envelope, which is what a refused privileged change looks like.
+		return s.classifier.classify(err)
+	}
+	return nil
+}
+
+// Privilege reports whether this UI process could carry out the changes the
+// daemon restricts to root/administrator, and the command that performs the one
+// users hit in the SSH settings. It applies the daemon's own rule to what it can
+// see locally, so the frontend can present those controls as unavailable up front
+// instead of letting a save fail. No daemon round-trip, so it also works while the
+// daemon is down.
+//
+// Being root or an elevated administrator is one way. The other is running as the
+// daemon's own user while the daemon is unprivileged, which the daemon accepts
+// because such a caller can already rewrite the config it reads; that is the
+// rootless-container and Windows netstack-mode case, and it is read from the
+// ownership of the socket or pipe the daemon created.
+func (s *Settings) Privilege() Privilege {
+	id, err := ipcauth.CurrentProcessIdentity()
+	if err != nil {
+		// Fail closed: report unprivileged, which only ever disables controls.
+		log.Warnf("cannot read this process's identity, treating it as unprivileged: %v", err)
+		return newPrivilege(false)
+	}
+	if id.IsPrivileged() {
+		return newPrivilege(true)
+	}
+	return newPrivilege(daemonaddr.DaemonRunsAsSelf(s.daemonAddr))
+}
+
+func newPrivilege(privileged bool) Privilege {
+	return Privilege{
+		Privileged:     privileged,
+		Actor:          ipcauth.PrivilegedActor(),
+		AllowSSHServer: ipcauth.UpCommand("--allow-server-ssh"),
+		EnableSSHRoot:  ipcauth.UpCommand("--enable-ssh-root"),
+		DisableSSHAuth: ipcauth.UpCommand("--disable-ssh-auth"),
+	}
 }
 
 func (s *Settings) GetRestrictions(ctx context.Context) (Restrictions, error) {

client/ui/services/windowmanager.go

@@ -393,15 +393,17 @@ func (s *WindowManager) CloseWelcome() {
 	}
 }
 
-// OpenError shows the custom error dialog; title/message are pre-localised and ride in the
-// start URL. A second error replaces the open one via SetURL. Singleton, destroyed on close.
-func (s *WindowManager) OpenError(title, message string) {
+// OpenError shows the custom error dialog; title/message/command are pre-localised
+// and ride in the start URL. command is optional and, when set, is offered for
+// copying so the user can run the operation the daemon refused. A second error
+// replaces the open one via SetURL. Singleton, destroyed on close.
+func (s *WindowManager) OpenError(title, message, command string) {
 	if ShuttingDown() {
 		return
 	}
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	startURL := errorDialogURL(title, message)
+	startURL := errorDialogURL(title, message, command)
 	if s.errorDialog == nil {
 		s.errorDialog = s.app.Window.NewWithOptions(
 			DialogWindowOptions("error", s.title("window.title.error"), startURL, s.linuxIcon),
@@ -601,8 +603,8 @@ func (s *WindowManager) getScreenBasedOnCursorPosition() *application.Screen {
 	return nil
 }
 
-// errorDialogURL builds the error window's start URL with title/message as escaped query params.
-func errorDialogURL(title, message string) string {
+// errorDialogURL builds the error window's start URL with title/message/command as escaped query params.
+func errorDialogURL(title, message, command string) string {
 	q := url.Values{}
 	if title != "" {
 		q.Set("title", title)
@@ -610,6 +612,9 @@ func errorDialogURL(title, message string) string {
 	if message != "" {
 		q.Set("message", message)
 	}
+	if command != "" {
+		q.Set("command", command)
+	}
 	startURL := "/#/dialog/error"
 	if enc := q.Encode(); enc != "" {
 		startURL += "?" + enc