Add an optional --allow-group flag restricting the daemon sockets to a group

client/cmd/service_allow_group.go

@@ -0,0 +1,70 @@
+//go:build !ios && !android
+
+package cmd
+
+import (
+	"fmt"
+	"slices"
+	"strings"
+)
+
+// Principal kinds an --allow-group value resolves to. The kind:value form is
+// the same one profile owners use, so a value in service.json or in a service
+// unit says which namespace it belongs to instead of being a bare number that
+// means one thing on Unix and another on Windows.
+const (
+	allowGroupKindGID = "gid"
+	allowGroupKindSID = "sid"
+)
+
+// resolveAllowGroups turns the values given on --allow-group into the typed
+// principals the daemon enforces on its sockets, dropping empty entries and
+// duplicates. Names are resolved through the platform's directory service, so
+// an entry that does not resolve is an error: a restriction the daemon cannot
+// evaluate must not become one that admits everybody. Values already in
+// kind:value form are validated and passed through, which is the form an
+// installed service hands to `service run`.
+func resolveAllowGroups(values []string) ([]string, error) {
+	var resolved []string
+	for _, value := range values {
+		value = strings.TrimSpace(value)
+		if value == "" {
+			continue
+		}
+
+		principal, err := resolveAllowGroup(value)
+		if err != nil {
+			return nil, fmt.Errorf("resolve --allow-group %q: %w", value, err)
+		}
+		if !slices.Contains(resolved, principal) {
+			resolved = append(resolved, principal)
+		}
+	}
+
+	if err := checkAllowGroupSet(resolved); err != nil {
+		return nil, err
+	}
+	return resolved, nil
+}
+
+// cutKind splits a value on the kind separator. ok is false when the value
+// carries no kind, which is the case for a plain group or account name: neither
+// a Unix group name nor a Windows account name may contain a colon, so the
+// separator is unambiguous.
+func cutKind(value string) (kind, rest string, ok bool) {
+	kind, rest, ok = strings.Cut(value, ":")
+	if !ok || rest == "" {
+		return "", value, false
+	}
+	return kind, rest, true
+}
+
+// principalValue returns the value part of a kind:value principal of the
+// expected kind.
+func principalValue(principal, kind string) (string, bool) {
+	got, value, ok := strings.Cut(principal, ":")
+	if !ok || got != kind || value == "" {
+		return "", false
+	}
+	return value, true
+}