Add an optional --allow-group flag restricting the daemon sockets to a group

client/cmd/service_installer.go

@@ -71,6 +71,13 @@ func buildServiceArguments() []string {
 		args = append(args, "--enable-json-socket", "--json-socket", jsonSocket)
 	}
 
+	// The resolved principals rather than the names the administrator typed, so
+	// the daemon needs no directory lookup on the boot path and a group renamed
+	// or recreated after the install cannot silently change who may connect.
+	for _, principal := range resolvedAllowGroups {
+		args = append(args, "--allow-group", principal)
+	}
+
 	return args
 }
 
@@ -114,6 +121,15 @@ func createServiceConfigForInstall() (*service.Config, error) {
 		return nil, err
 	}
 
+	// Resolved here, where a name that does not exist fails the install in front
+	// of the administrator, rather than at boot where it would leave the daemon
+	// unable to serve anybody.
+	resolved, err := resolveAllowGroups(allowGroups)
+	if err != nil {
+		return nil, err
+	}
+	resolvedAllowGroups = resolved
+
 	svcConfig, err := newSVCConfig()
 	if err != nil {
 		return nil, fmt.Errorf("create service config: %w", err)