[client] Improve error surfacing for restricted daemon sockets (#7704)

* Add probe for daemon restriction and improve error surfacing

client/cmd/daemon_access_unix_test.go

@@ -0,0 +1,46 @@
+//go:build !windows
+
+package cmd
+
+import (
+	"context"
+	"errors"
+	"net"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// A socket the caller may not write must fail the dial with the denial, well
+// before the dial timeout.
+func TestDialClientGRPCServer_SocketRefusesCaller(t *testing.T) {
+	if os.Geteuid() == 0 {
+		t.Skip("root bypasses socket file permissions")
+	}
+	dir, err := os.MkdirTemp("", "nbdial")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = os.RemoveAll(dir) })
+	path := filepath.Join(dir, "d.sock")
+	ln, err := net.Listen("unix", path)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = ln.Close() })
+	require.NoError(t, os.Chmod(path, 0o000))
+
+	start := time.Now()
+	_, err = DialClientGRPCServer(context.Background(), "unix://"+path)
+	elapsed := time.Since(start)
+
+	require.Error(t, err)
+	assert.ErrorIs(t, err, errDaemonAccessDenied)
+	assert.Less(t, elapsed, 5*time.Second, "a refused socket must not wait out the dial timeout")
+	assert.Equal(t, errDaemonAccessDenied, daemonConnectError(err), "the denial is reported without the start-the-service hint")
+}
+
+func TestDaemonConnectError_KeepsServiceHintOtherwise(t *testing.T) {
+	err := daemonConnectError(errors.New("context deadline exceeded"))
+	assert.Contains(t, err.Error(), "netbird service start", "a daemon that did not answer keeps the hint to start it")
+}