Add an optional --allow-group flag restricting the daemon sockets to a group

client/cmd/service.go

@@ -31,6 +31,14 @@ var (
 	serviceEnvVars   []string
 	jsonSocket       string
 	enableJSONSocket bool
+	// allowGroups holds the --allow-group values as given: group or account
+	// names, or principals already in kind:value form. resolveAllowGroups turns
+	// them into the principals the daemon enforces.
+	allowGroups []string
+	// resolvedAllowGroups holds those principals after the install-time
+	// resolution, for persisting and for the arguments the installed service
+	// runs with.
+	resolvedAllowGroups []string
 )
 
 type program struct {
@@ -63,6 +71,14 @@ func init() {
 	serviceCmd.PersistentFlags().BoolVar(&enableJSONSocket, "enable-json-socket", false, "Enables the HTTP/JSON API socket served by grpc-gateway. To persist, use: netbird service install --enable-json-socket")
 	serviceCmd.PersistentFlags().StringVar(&jsonSocket, "json-socket", defaultJSONSocket, "HTTP/JSON API socket address [unix|tcp]://[path|host:port]. Requires --enable-json-socket to serve. To persist, use: netbird service install --enable-json-socket --json-socket")
 
+	allowGroupDesc := `Restricts the daemon control socket and the JSON socket to the given group. ` +
+		`Local accounts outside it cannot connect at all, so nothing the daemon exposes is reachable from them. ` +
+		`Takes a group name, or a numeric GID on Unix and a SID on Windows; ` +
+		`Unix accepts a single group, Windows a comma-separated list of groups or accounts. ` +
+		`Names are resolved when the service is installed, LDAP, SSSD and Active Directory groups included. ` +
+		`To persist, use: netbird service install --allow-group`
+	serviceCmd.PersistentFlags().StringSliceVar(&allowGroups, "allow-group", nil, allowGroupDesc)
+
 	rootCmd.PersistentFlags().StringVarP(&serviceName, "service", "s", defaultServiceName, "Netbird system service name")
 	serviceEnvDesc := `Sets extra environment variables for the service. ` +
 		`You can specify a comma-separated list of KEY=VALUE pairs. ` +