Merge branch 'main' into mdm_integration

2026-09-19 21:29:09 +02:00 · 2026-08-26 10:00:11 +02:00
parent c281b15cfa ed7d4de999
commit ec4b99bdc5
105 changed files with 6362 additions and 2174 deletions
@@ -2,6 +2,7 @@ package internal

 import (
 	"context"
+	"maps"
 	"os"
 	"strconv"
 	"sync"
@@ -14,6 +15,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/peerstore"
 	"github.com/netbirdio/netbird/route"
+	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
 )

 // lazyForce is the resolved local decision for lazy connections, layered above the
@@ -42,6 +44,9 @@ type ConnMgr struct {
 	iface            lazyconn.WGIface
 	force            lazyForce
 	rosenpassEnabled bool
+	// remoteLazyEnabled caches the account-wide lazy feature flag from management.
+	// It is the default for peers that do not carry a per-peer lazy hint.
+	remoteLazyEnabled bool

 	lazyConnMgr *manager.Manager
 	// lazyConnMgrMu guards the lazyConnMgr pointer for readers outside the
@@ -53,6 +58,10 @@ type ConnMgr struct {
 	// (re)armed (Mode A at arm time). Injected by the engine; nil disables the reconcile.
 	reconcileRoutedIPs func(peerKey string) error

+	// appliedExcludeList is the exclude set last handed to the lazy manager, kept so an
+	// unchanged set on the next sync skips the O(n) reconciliation.
+	appliedExcludeList map[string]bool
+
 	wg            sync.WaitGroup
 	lazyCtx       context.Context
 	lazyCtxCancel context.CancelFunc
@@ -75,69 +84,56 @@ func NewConnMgr(engineConfig *EngineConfig, statusRecorder *peer.Status, peerSto
 	return e
 }

-// Start initializes the connection manager. It starts the lazy connection manager when a
-// local override forces it on; with no local override it waits for the management feature flag.
+// Start initializes the connection manager. The lazy connection manager always runs so that
+// per-peer lazy defaults (e.g. proxy peers) work even when the account flag is off; the
+// account flag and the local override decide the default lazy state per peer (see
+// PeerLazyDefault). Rosenpass is the only condition that disables it.
 func (e *ConnMgr) Start(ctx context.Context) {
 	if e.lazyConnMgr != nil {
 		log.Errorf("lazy connection manager is already started")
 		return
 	}

-	switch e.force {
-	case lazyForceOff:
-		log.Infof("lazy connection manager is disabled by local override (%s or MDM policy)", lazyconn.EnvLazyConn)
-		e.statusRecorder.UpdateLazyConnection(false)
-		return
-	case lazyForceNone:
-		log.Infof("lazy connection manager is managed by the management feature flag")
-		e.statusRecorder.UpdateLazyConnection(false)
-		return
-	}
-
 	if e.rosenpassEnabled {
-		log.Warnf("rosenpass connection manager is enabled, lazy connection manager will not be started")
+		log.Warnf("rosenpass is enabled, lazy connection manager will not be started")
 		e.statusRecorder.UpdateLazyConnection(false)
 		return
 	}

 	e.initLazyManager(ctx)
-	e.statusRecorder.UpdateLazyConnection(true)
+	e.statusRecorder.UpdateLazyConnection(e.PeerLazyDefault(mgmProto.LazyState_LazyStateDefault))
 }

-// UpdatedRemoteFeatureFlag is called when the remote feature flag is updated.
-// If enabled, it initializes the lazy connection manager and start it. Do not need to call Start() again.
-// If disabled, then it closes the lazy connection manager and open the connections to all peers.
-func (e *ConnMgr) UpdatedRemoteFeatureFlag(ctx context.Context, enabled bool) error {
-	// a local override (NB_LAZY_CONN or local config) takes precedence over management
-	if e.force != lazyForceNone {
-		return nil
+// UpdatedRemoteFeatureFlag caches the account-wide lazy feature flag. The manager itself is
+// not started or stopped here; the per-sync exclude-list reconciliation moves normal peers
+// between the lazy and always-active sets when the flag flips.
+func (e *ConnMgr) UpdatedRemoteFeatureFlag(_ context.Context, enabled bool) error {
+	e.remoteLazyEnabled = enabled
+	if e.isStartedWithLazyMgr() {
+		e.statusRecorder.UpdateLazyConnection(e.PeerLazyDefault(mgmProto.LazyState_LazyStateDefault))
+	}
+	return nil
+}
+
+// PeerLazyDefault reports whether a peer should be lazy. The local override
+// (NB_LAZY_CONN/MDM) wins over everything; without a local override the
+// management per-peer state applies (LazyStateLazy/Eager force the decision),
+// and LazyStateDefault follows the account-wide flag.
+func (e *ConnMgr) PeerLazyDefault(state mgmProto.LazyState) bool {
+	switch e.force {
+	case lazyForceOn:
+		return true
+	case lazyForceOff:
+		return false
 	}

-	if enabled {
-		// if the lazy connection manager is already started, do not start it again
-		if e.lazyConnMgr != nil {
-			return nil
-		}
-
-		if e.rosenpassEnabled {
-			log.Infof("rosenpass connection manager is enabled, lazy connection manager will not be started")
-			e.statusRecorder.UpdateLazyConnection(false)
-			return nil
-		}
-
-		log.Infof("lazy connection manager is enabled by the management feature flag")
-		e.initLazyManager(ctx)
-		e.statusRecorder.UpdateLazyConnection(true)
-		return e.addPeersToLazyConnManager()
-	} else {
-		if e.lazyConnMgr == nil {
-			e.statusRecorder.UpdateLazyConnection(false)
-			return nil
-		}
-		log.Infof("lazy connection manager is disabled by management feature flag")
-		e.closeManager(ctx)
-		e.statusRecorder.UpdateLazyConnection(false)
-		return nil
+	switch state {
+	case mgmProto.LazyState_LazyStateLazy:
+		return true
+	case mgmProto.LazyState_LazyStateEager:
+		return false
+	default:
+		return e.remoteLazyEnabled
 	}
 }

@@ -157,6 +153,13 @@ func (e *ConnMgr) SetExcludeList(ctx context.Context, peerIDs map[string]bool) {
 		return
 	}

+	// The exclude set is recomputed every sync but rarely changes; skip the O(n)
+	// store lookups and reconciliation when it matches what was already applied.
+	if maps.Equal(peerIDs, e.appliedExcludeList) {
+		return
+	}
+	e.appliedExcludeList = maps.Clone(peerIDs)
+
 	excludedPeers := make([]lazyconn.PeerConfig, 0, len(peerIDs))

 	for peerID := range peerIDs {
@@ -192,12 +195,16 @@ func (e *ConnMgr) SetExcludeList(ctx context.Context, peerIDs map[string]bool) {
 	}
 }

-func (e *ConnMgr) AddPeerConn(ctx context.Context, peerKey string, conn *peer.Conn) (exists bool) {
+// AddPeerConn registers a peer connection. permanent requests an always-active connection
+// (the peer belongs to the exclude set: a forwarder, or a peer that is not lazy by policy).
+// Non-permanent peers are handed to the lazy manager. The subsequent SetExcludeList call
+// reconciles membership for existing peers across flag flips.
+func (e *ConnMgr) AddPeerConn(ctx context.Context, peerKey string, conn *peer.Conn, permanent bool) (exists bool) {
 	if success := e.peerStore.AddPeerConn(peerKey, conn); !success {
 		return true
 	}

-	if !e.isStartedWithLazyMgr() {
+	if !e.isStartedWithLazyMgr() || permanent {
 		if err := conn.Open(ctx); err != nil {
 			conn.Log.Errorf("failed to open connection: %v", err)
 		}
@@ -296,6 +303,8 @@ func (e *ConnMgr) Close() {
 	e.lazyConnMgrMu.Lock()
 	e.lazyConnMgr = nil
 	e.lazyConnMgrMu.Unlock()
+
+	e.appliedExcludeList = nil
 }

 func (e *ConnMgr) initLazyManager(engineCtx context.Context) {
@@ -309,6 +318,8 @@ func (e *ConnMgr) initLazyManager(engineCtx context.Context) {
 	e.lazyCtx, e.lazyCtxCancel = context.WithCancel(engineCtx)
 	e.lazyConnMgrMu.Unlock()

+	e.appliedExcludeList = nil
+
 	e.wg.Add(1)
 	go func() {
 		defer e.wg.Done()
@@ -316,46 +327,6 @@ func (e *ConnMgr) initLazyManager(engineCtx context.Context) {
 	}()
 }

-func (e *ConnMgr) addPeersToLazyConnManager() error {
-	peers := e.peerStore.PeersPubKey()
-	lazyPeerCfgs := make([]lazyconn.PeerConfig, 0, len(peers))
-	for _, peerID := range peers {
-		var peerConn *peer.Conn
-		var exists bool
-		if peerConn, exists = e.peerStore.PeerConn(peerID); !exists {
-			log.Warnf("failed to find peer conn for peerID: %s", peerID)
-			continue
-		}
-
-		lazyPeerCfg := lazyconn.PeerConfig{
-			PublicKey:  peerID,
-			AllowedIPs: peerConn.WgConfig().AllowedIps,
-			PeerConnID: peerConn.ConnID(),
-			Log:        peerConn.Log,
-		}
-		lazyPeerCfgs = append(lazyPeerCfgs, lazyPeerCfg)
-	}
-
-	return e.lazyConnMgr.AddActivePeers(lazyPeerCfgs)
-}
-
-func (e *ConnMgr) closeManager(ctx context.Context) {
-	if e.lazyConnMgr == nil {
-		return
-	}
-
-	e.lazyCtxCancel()
-	e.wg.Wait()
-
-	e.lazyConnMgrMu.Lock()
-	e.lazyConnMgr = nil
-	e.lazyConnMgrMu.Unlock()
-
-	for _, peerID := range e.peerStore.PeersPubKey() {
-		e.peerStore.PeerConnOpen(ctx, peerID)
-	}
-}
-
 func (e *ConnMgr) isStartedWithLazyMgr() bool {
 	return e.lazyConnMgr != nil && e.lazyCtxCancel != nil
 }
@@ -16,6 +16,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/peerstore"
 	"github.com/netbirdio/netbird/monotime"
+	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
 )

 func TestResolveLazyForce(t *testing.T) {
@@ -138,4 +139,91 @@ func TestInactivityThresholdEnv(t *testing.T) {
 	}
 }

+func TestPeerLazyDefault(t *testing.T) {
+	tests := []struct {
+		name          string
+		force         lazyForce
+		remoteEnabled bool
+		state         mgmProto.LazyState
+		want          bool
+	}{
+		{name: "force on wins over eager state", force: lazyForceOn, state: mgmProto.LazyState_LazyStateEager, want: true},
+		{name: "force off wins over lazy state", force: lazyForceOff, remoteEnabled: true, state: mgmProto.LazyState_LazyStateLazy, want: false},
+		{name: "none, default, account off -> active", force: lazyForceNone, state: mgmProto.LazyState_LazyStateDefault, want: false},
+		{name: "none, default, account on -> lazy", force: lazyForceNone, remoteEnabled: true, state: mgmProto.LazyState_LazyStateDefault, want: true},
+		{name: "none, lazy state, account off -> lazy", force: lazyForceNone, state: mgmProto.LazyState_LazyStateLazy, want: true},
+		{name: "none, eager state, account on -> active", force: lazyForceNone, remoteEnabled: true, state: mgmProto.LazyState_LazyStateEager, want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			e := &ConnMgr{force: tt.force, remoteLazyEnabled: tt.remoteEnabled}
+			if got := e.PeerLazyDefault(tt.state); got != tt.want {
+				t.Fatalf("PeerLazyDefault(%v) = %v, want %v", tt.state, got, tt.want)
+			}
+		})
+	}
+}
+
 func durPtr(d time.Duration) *time.Duration { return &d }
+
+// TestToExcludedLazyPeers covers the per-peer lazy classification (proxy vs
+// normal, across the force/account-flag matrix). Forwarder-target exclusion is
+// covered by TestToExcludedLazyPeers_ForwardTarget.
+func TestToExcludedLazyPeers(t *testing.T) {
+	const (
+		normalKey = "normal"
+		lazyKey   = "lazy-state"
+		eagerKey  = "eager-state"
+	)
+
+	peers := []*mgmProto.RemotePeerConfig{
+		{WgPubKey: normalKey, AllowedIps: []string{"100.64.0.1/32"}},
+		{WgPubKey: lazyKey, AllowedIps: []string{"100.64.0.2/32"}, LazyState: mgmProto.LazyState_LazyStateLazy},
+		{WgPubKey: eagerKey, AllowedIps: []string{"100.64.0.3/32"}, LazyState: mgmProto.LazyState_LazyStateEager},
+	}
+
+	tests := []struct {
+		name          string
+		force         lazyForce
+		remoteEnabled bool
+		want          map[string]bool
+	}{
+		{
+			name:  "account off: lazy-state peer lazy, normal + eager active",
+			force: lazyForceNone, remoteEnabled: false,
+			want: map[string]bool{normalKey: true, eagerKey: true},
+		},
+		{
+			name:  "account on: only eager-state peer active",
+			force: lazyForceNone, remoteEnabled: true,
+			want: map[string]bool{eagerKey: true},
+		},
+		{
+			name:  "force off: everything active",
+			force: lazyForceOff, remoteEnabled: true,
+			want: map[string]bool{normalKey: true, lazyKey: true, eagerKey: true},
+		},
+		{
+			name:  "force on: nothing active",
+			force: lazyForceOn, remoteEnabled: false,
+			want: map[string]bool{},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			e := &Engine{connMgr: &ConnMgr{force: tt.force, remoteLazyEnabled: tt.remoteEnabled}}
+			got := e.toExcludedLazyPeers(nil, peers)
+
+			if len(got) != len(tt.want) {
+				t.Fatalf("toExcludedLazyPeers() = %v, want %v", got, tt.want)
+			}
+			for k := range tt.want {
+				if !got[k] {
+					t.Fatalf("expected peer %s excluded, got %v", k, got)
+				}
+			}
+		})
+	}
+}
@@ -38,8 +38,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/updater"
 	"github.com/netbirdio/netbird/client/internal/updater/installer"
 	nbnet "github.com/netbirdio/netbird/client/net"
-	"github.com/netbirdio/netbird/client/netstate"
-	"github.com/netbirdio/netbird/client/netsweep"
+	"github.com/netbirdio/netbird/client/netevents"
 	cProto "github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/ssh"
 	sshconfig "github.com/netbirdio/netbird/client/ssh/config"
@@ -73,28 +72,17 @@ type ConnectClient struct {

 	persistSyncResponse bool

-	// netState gates every reconnection loop on OS-reported network
-	// availability. Nil (the default) disables gating; mobile platforms
-	// inject it via WithNetworkState.
-	netState *netstate.State
-
-	// sweeper cuts the management, signal and relay connections on network
-	// change; nil disables it.
-	sweeper *netsweep.Sweeper
+	// netMgr gates every reconnection loop on OS-reported network
+	// availability and sweeps connections on network change.
+	netMgr *netevents.Manager
 }

 // ConnectClientOption configures optional ConnectClient behavior.
 type ConnectClientOption func(*ConnectClient)

-// WithNetworkState injects the OS network availability state that gates every
-// reconnection loop; without it gating is disabled.
-func WithNetworkState(netState *netstate.State) ConnectClientOption {
-	return func(c *ConnectClient) { c.netState = netState }
-}
-
-// WithSweeper injects the network change sweeper.
-func WithSweeper(sweeper *netsweep.Sweeper) ConnectClientOption {
-	return func(c *ConnectClient) { c.sweeper = sweeper }
+// WithNetEvents injects the OS network event handling.
+func WithNetEvents(events *netevents.Manager) ConnectClientOption {
+	return func(c *ConnectClient) { c.netMgr = events }
 }

 func NewConnectClient(
@@ -305,7 +293,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		}

 		// suspend connection attempts while the OS reports no usable network
-		if waited, err := c.netState.Wait(c.ctx); err != nil {
+		if waited, err := c.netMgr.Wait(c.ctx); err != nil {
 			return nil
 		} else if waited {
 			backOff.Reset()
@@ -323,7 +311,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan

 		log.Debugf("connecting to the Management service %s", c.config.ManagementURL.Host)
 		mgmClient, err := mgm.NewClient(engineCtx, c.config.ManagementURL.Host, myPrivateKey, mgmTlsEnabled,
-			mgm.WithNetworkState(c.netState), mgm.WithSweeper(c.sweeper))
+			mgm.WithNetEvents(c.netMgr))
 		if err != nil {
 			// On daemon shutdown / Down() the parent context is cancelled
 			// and the dial fails with "context canceled". Wrapping that
@@ -398,7 +386,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		}()

 		// with the global Netbird config in hand connect (just a connection, no stream yet) Signal
-		signalClient, err := connectToSignal(engineCtx, loginResp.GetNetbirdConfig(), myPrivateKey, c.netState, c.sweeper)
+		signalClient, err := connectToSignal(engineCtx, loginResp.GetNetbirdConfig(), myPrivateKey, c.netMgr)
 		if err != nil {
 			log.Error(err)
 			return wrapErr(err)
@@ -435,7 +423,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		}

 		relayManager := relayClient.NewManager(engineCtx, relayURLs, myPrivateKey.PublicKey().String(), engineConfig.MTU,
-			relayClient.WithNetworkState(c.netState), relayClient.WithSweeper(c.sweeper))
+			relayClient.WithNetEvents(c.netMgr))
 		c.statusRecorder.SetRelayMgr(relayManager)
 		if len(relayURLs) > 0 {
 			if token != nil {
@@ -463,7 +451,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			UpdateManager:  c.updateManager,
 			ClientMetrics:  c.clientMetrics,
 			MetricsCtx:     c.ctx,
-			NetState:       c.netState,
+			NetMgr:         c.netMgr,
 		}, mobileDependency)
 		engine.SetSyncResponsePersistence(c.persistSyncResponse)
 		c.engine = engine
@@ -723,7 +711,7 @@ func selectMTU(localMTU uint16, peerMTU int32) uint16 {
 }

 // connectToSignal creates Signal Service client and established a connection
-func connectToSignal(ctx context.Context, wtConfig *mgmProto.NetbirdConfig, ourPrivateKey wgtypes.Key, netState *netstate.State, sweeper *netsweep.Sweeper) (*signal.GrpcClient, error) {
+func connectToSignal(ctx context.Context, wtConfig *mgmProto.NetbirdConfig, ourPrivateKey wgtypes.Key, netMgr *netevents.Manager) (*signal.GrpcClient, error) {
 	var sigTLSEnabled bool
 	if wtConfig.Signal.Protocol == mgmProto.HostConfig_HTTPS {
 		sigTLSEnabled = true
@@ -732,7 +720,7 @@ func connectToSignal(ctx context.Context, wtConfig *mgmProto.NetbirdConfig, ourP
 	}

 	signalClient, err := signal.NewClient(ctx, wtConfig.Signal.Uri, ourPrivateKey, sigTLSEnabled,
-		signal.WithNetworkState(netState), signal.WithSweeper(sweeper))
+		signal.WithNetEvents(netMgr))
 	if err != nil {
 		log.Errorf("error while connecting to the Signal Exchange Service %s: %s", wtConfig.Signal.Uri, err)
 		return nil, gstatus.Errorf(codes.FailedPrecondition, "failed connecting to Signal Service : %s", err)
@@ -0,0 +1,17 @@
+package daemonaddr
+
+import "strings"
+
+// CarriesIdentity reports whether the control channel at addr conveys the
+// connecting process's identity to the daemon. A Unix socket carries peer
+// credentials and a named pipe carries the client's token. Nothing else does, TCP
+// included, and there the daemon can authorize a privileged operation for nobody
+// at all: see ResolveDaemonAddr, which says as much to anyone still reaching the
+// Windows daemon on the address it served before it had a pipe.
+//
+// A client uses this to tell whether becoming privileged would get it anywhere.
+// It answers from the scheme and nothing else, so an address it does not
+// recognise counts as carrying no identity.
+func CarriesIdentity(addr string) bool {
+	return strings.HasPrefix(addr, "unix://") || strings.HasPrefix(addr, pipeScheme)
+}
@@ -0,0 +1,29 @@
+package daemonaddr
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCarriesIdentity(t *testing.T) {
+	tests := []struct {
+		addr string
+		want bool
+	}{
+		{"unix:///var/run/netbird.sock", true},
+		{"unix:///var/run/netbird/default.sock", true},
+		{"npipe://netbird", true},
+		{`npipe://\\.\pipe\ProtectedPrefix\Administrators\netbird`, true},
+		{"tcp://127.0.0.1:41731", false},
+		{"tcp://localhost:41731", false},
+		{"", false},
+		{"/var/run/netbird.sock", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.addr, func(t *testing.T) {
+			assert.Equal(t, tt.want, CarriesIdentity(tt.addr), "address %q", tt.addr)
+		})
+	}
+}
@@ -0,0 +1,74 @@
+// Package elevate re-runs this very executable under the operating system's own
+// privilege-elevation mechanism and waits for it to finish.
+//
+// It exists so that a change the daemon restricts to root/administrator can be
+// authorized from the GUI, by the user, at the moment they ask for it: Windows
+// shows the UAC consent dialog, macOS the system authentication dialog, and
+// Linux/FreeBSD the session's polkit agent. The credentials, where any are
+// asked for, are collected by the operating system and never pass through
+// NetBird.
+//
+// What the elevated process then does is the caller's business: it is the same
+// binary, in a one-shot mode, and it is authorized by the daemon exactly like
+// any other privileged caller, from the identity the kernel reports on the
+// control channel. Nothing here grants privilege, and the daemon gains no new
+// way to be talked into something: elevation only changes who is calling it.
+package elevate
+
+import (
+	"context"
+	"errors"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// AppliedMarker is what the elevated process prints on standard output once it has
+// done what it was run for.
+//
+// macOS's AuthorizationExecuteWithPrivileges reports no exit status and does not
+// say which process it started, so there this line is the only evidence that the
+// change was applied. The other platforms have an exit code and ignore it.
+const AppliedMarker = "netbird-elevated: applied"
+
+var (
+	// ErrDeclined reports that the user dismissed the prompt or did not
+	// authenticate. Nothing happened and nothing is wrong: a caller undoes its
+	// optimistic update and stays quiet.
+	ErrDeclined = errors.New("authorization declined")
+
+	// ErrUnavailable reports that this host has no elevation mechanism we can
+	// drive: no polkit on a Unix desktop, or an executable we decline to run as
+	// root. A caller falls back to telling the user which command to run.
+	ErrUnavailable = errors.New("no privilege elevation mechanism available")
+)
+
+// Run runs this executable with args under the platform's elevation mechanism
+// and waits for it to exit. A non-zero exit is returned as an error, so the
+// caller can treat a completed Run as the operation having succeeded.
+//
+// The args are the caller's own command line, so they cross no privilege
+// boundary: only a user who has just authenticated as an administrator can get
+// them run at all.
+func Run(ctx context.Context, args ...string) error {
+	self, err := trustedSelf()
+	if err != nil {
+		return err
+	}
+	return run(ctx, self, args)
+}
+
+// Available reports whether Run has a mechanism to use on this host, so a caller
+// can offer the prompt only when there is one and otherwise fall back to
+// guidance the user can act on. It answers from what is installed, not from what
+// the user is allowed to do: an administrator's password may still be required
+// and may still not be given, which is ErrDeclined from Run.
+func Available() bool {
+	if _, err := trustedSelf(); err != nil {
+		// Worth a line: this is also what a build run from a group-writable
+		// directory hits, and there is nothing in the UI to say why the offer is
+		// missing.
+		log.Debugf("not offering privilege elevation: %v", err)
+		return false
+	}
+	return mechanismAvailable()
+}
@@ -0,0 +1,18 @@
+package elevate
+
+import "strings"
+
+// noOutput stands in for a process that said nothing, so that a report of what it
+// said still reads as a sentence.
+const noOutput = "no output"
+
+func firstLine(s string) string {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return noOutput
+	}
+	if i := strings.IndexByte(s, '\n'); i >= 0 {
+		return s[:i]
+	}
+	return s
+}
@@ -0,0 +1,21 @@
+package elevate
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestFirstLine(t *testing.T) {
+	tests := []struct{ in, want string }{
+		{in: "", want: noOutput},
+		{in: "  \n ", want: noOutput},
+		{in: "one line", want: "one line"},
+		{in: "first\nsecond", want: "first"},
+		{in: "\nsecond\n", want: "second"},
+	}
+
+	for _, tt := range tests {
+		assert.Equal(t, tt.want, firstLine(tt.in), "input %q", tt.in)
+	}
+}
@@ -0,0 +1,359 @@
+package elevate
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"runtime"
+	"strings"
+	"sync"
+	"syscall"
+	"unsafe"
+
+	"github.com/ebitengine/purego"
+	log "github.com/sirupsen/logrus"
+)
+
+// Authorization Services, reached through purego rather than cgo so the released
+// binaries keep building with CGO_ENABLED=0.
+//
+// The prompt belongs to this process, which is what makes it carry the
+// application's name and our own explanation. Going through osascript instead puts
+// the very same trampoline behind a dialog attributed to osascript, and means
+// handing a shell a command line to re-parse.
+//
+// # On AuthorizationExecuteWithPrivileges
+//
+// It is deprecated, and Apple's guidance (Quinn, "BSD Privilege Escalation on
+// macOS", developer.apple.com/forums/thread/708765) is "while it still works, it's
+// been deprecated for many years. Do not use it in a widely distributed product."
+// It is used here anyway, knowingly, because the alternatives Apple offers are for
+// *obtaining* ongoing privileges — an installer package, SMAppService, SMJobBless —
+// and NetBird already has what they would install: a launchd daemon running as
+// root. What is missing is only a way for an unprivileged client to ask it to act.
+//
+// The way to that without a deprecated call is to authorize the client instead of
+// elevating one: the app takes the right with AuthorizationCreate, passes the
+// AuthorizationExternalForm to the daemon, and the daemon checks it with
+// AuthorizationCopyRights before acting — none of which is deprecated. It is the
+// better design and it is where this should end up. It also means the daemon
+// accepting an authorization over its control socket, which is a new way to be
+// asked for privileged work and wants reviewing as such, so it is deliberately not
+// bundled in with the rest of this.
+//
+// Until then, three things keep the deprecation from being a trap. Every symbol is
+// resolved with an error rather than a panic, so a macOS that has dropped this
+// function leaves the app offering the user a command instead of crashing on the
+// way to a prompt. A failure to run the tool is reported as ErrUnavailable, so the
+// fallback is the same one an agent-less Linux session gets. And the whole path
+// runs under guard, which turns a panic out of the FFI layer into that same
+// fallback.
+//
+// The trampoline passes on the environment it was given, so what it starts as root
+// must be an executable this user's peers cannot influence: that is what
+// trustedSelf refuses, and what signing the binary settles for the loader.
+
+const (
+	securityFramework = "/System/Library/Frameworks/Security.framework/Security"
+	libSystem         = "/usr/lib/libSystem.B.dylib"
+
+	// trampoline is what the framework hands the tool to. Present on every macOS,
+	// and worth confirming before offering a prompt rather than mid-prompt.
+	trampoline = "/usr/libexec/security_authtrampoline"
+)
+
+// rightExecute is the right an administrator holds, and what
+// AuthorizationExecuteWithPrivileges requires of us.
+const rightExecute = "system.privilege.admin"
+
+// promptKey is kAuthorizationEnvironmentPrompt, which puts a sentence of ours above
+// the system's in the dialog. It is about the change rather than the mechanism.
+const (
+	promptKey  = "prompt"
+	promptText = "NetBird needs to change a setting that grants SSH access to this computer."
+)
+
+// OSStatus values from SecBase.h that mean something to us; anything else is
+// reported as it comes.
+const (
+	errAuthorizationSuccess               = 0
+	errAuthorizationDenied                = -60005
+	errAuthorizationCanceled              = -60006
+	errAuthorizationInteractionNotAllowed = -60007
+	errAuthorizationToolExecuteFailure    = -60031
+	errAuthorizationToolEnvironmentError  = -60032
+)
+
+// AuthorizationFlags from Authorization.h.
+const (
+	flagDefaults           = 0
+	flagInteractionAllowed = 1 << 0
+	flagExtendRights       = 1 << 1
+	flagDestroyRights      = 1 << 3
+	flagPreAuthorize       = 1 << 4
+)
+
+// authorizationItem mirrors AuthorizationItem: a name, and a value the name gives
+// meaning to. 32 bytes on both amd64 and arm64.
+type authorizationItem struct {
+	name        *byte
+	valueLength uintptr
+	value       unsafe.Pointer
+	// flags is reserved by the API and always zero. Declared because the layout
+	// is the contract: without it the struct is 24 bytes where C reads 32.
+	flags uint32 //nolint:unused // part of the C layout
+}
+
+// authorizationItemSet mirrors AuthorizationItemSet, which serves as both an
+// AuthorizationRights and an AuthorizationEnvironment.
+type authorizationItemSet struct {
+	count uint32
+	items *authorizationItem
+}
+
+var (
+	authorizationCreate                func(rights, environment *authorizationItemSet, flags uint32, authorization *uintptr) int32
+	authorizationExecuteWithPrivileges func(authorization uintptr, pathToTool string, options uint32, arguments *uintptr, communicationsPipe *uintptr) int32
+	authorizationFree                  func(authorization uintptr, flags uint32) int32
+	fileno                             func(stream uintptr) int32
+	fclose                             func(stream uintptr) int32
+
+	loadOnce sync.Once
+	loadErr  error
+)
+
+// load resolves the functions once. A framework that cannot be opened, or a symbol
+// that is no longer there, leaves the host without a mechanism rather than taking
+// the process down with it: see the note on deprecation above.
+func load() error {
+	loadOnce.Do(func() { loadErr = guard("loading Security.framework", resolve) })
+	return loadErr
+}
+
+// guard turns a panic out of the FFI layer into an error, so an API that has
+// changed under us costs the user a prompt rather than the window they were
+// clicking in. purego panics on a signature it cannot map, and this is the one
+// place in the client that calls a deprecated system function.
+//
+// It catches Go panics, which is what purego raises. A fault inside the framework
+// itself is not a panic and not recoverable; the layout the tests pin down is what
+// stands between us and that.
+func guard(what string, fn func() error) (err error) {
+	defer func() {
+		r := recover()
+		if r == nil {
+			return
+		}
+		log.Errorf("%s panicked: %v", what, r)
+		err = fmt.Errorf("%w: %s: %v", ErrUnavailable, what, r)
+	}()
+	return fn()
+}
+
+func resolve() error {
+	security, err := purego.Dlopen(securityFramework, purego.RTLD_LAZY|purego.RTLD_GLOBAL)
+	if err != nil {
+		return fmt.Errorf("open %s: %w", securityFramework, err)
+	}
+	system, err := purego.Dlopen(libSystem, purego.RTLD_LAZY|purego.RTLD_GLOBAL)
+	if err != nil {
+		return fmt.Errorf("open %s: %w", libSystem, err)
+	}
+
+	// purego.RegisterLibFunc panics on a symbol it cannot find, which is not how a
+	// deprecated function's disappearance should reach the user.
+	for _, fn := range []struct {
+		ptr    any
+		handle uintptr
+		name   string
+	}{
+		{&authorizationCreate, security, "AuthorizationCreate"},
+		{&authorizationExecuteWithPrivileges, security, "AuthorizationExecuteWithPrivileges"},
+		{&authorizationFree, security, "AuthorizationFree"},
+		{&fileno, system, "fileno"},
+		{&fclose, system, "fclose"},
+	} {
+		symbol, err := purego.Dlsym(fn.handle, fn.name)
+		if err != nil {
+			return fmt.Errorf("resolve %s: %w", fn.name, err)
+		}
+		if symbol == 0 {
+			return fmt.Errorf("resolve %s: not present on this system", fn.name)
+		}
+		purego.RegisterFunc(fn.ptr, symbol)
+	}
+	return nil
+}
+
+// run asks the system to run self as root: first for the right, which is what puts
+// up the authentication dialog and collects the password or takes the Touch ID,
+// then for the tool. The credentials go to the system's authorization trampoline
+// and never to us.
+//
+// The context bounds only our own waiting; the dialog belongs to the system and
+// closes when the user answers it.
+func run(ctx context.Context, self string, args []string) error {
+	if err := load(); err != nil {
+		return fmt.Errorf("%w: %v", ErrUnavailable, err)
+	}
+
+	return guard("asking for privileges", func() error {
+		authorization, err := authorize()
+		if err != nil {
+			return err
+		}
+		defer authorizationFree(authorization, flagDestroyRights)
+
+		return execute(ctx, authorization, self, args)
+	})
+}
+
+func mechanismAvailable() bool {
+	if err := load(); err != nil {
+		return false
+	}
+	info, err := os.Stat(trampoline)
+	return err == nil && !info.IsDir()
+}
+
+// authorize obtains the right, prompting for it. A dismissed dialog comes back as
+// errAuthorizationCanceled and a password given up on as errAuthorizationDenied;
+// both are the user's answer rather than a failure.
+func authorize() (uintptr, error) {
+	var pinner runtime.Pinner
+	defer pinner.Unpin()
+
+	rights := itemSet(&pinner, authorizationItem{name: cString(&pinner, rightExecute)})
+	environment := itemSet(&pinner, promptItem(&pinner))
+
+	var authorization uintptr
+	status := authorizationCreate(rights, environment,
+		flagDefaults|flagInteractionAllowed|flagPreAuthorize|flagExtendRights, &authorization)
+
+	switch status {
+	case errAuthorizationSuccess:
+		return authorization, nil
+	case errAuthorizationCanceled, errAuthorizationDenied:
+		return 0, ErrDeclined
+	case errAuthorizationInteractionNotAllowed:
+		// Nowhere to put a dialog, so there is nobody to ask: a launch daemon, or
+		// a session with no window server.
+		return 0, fmt.Errorf("%w: this session cannot show an authorization prompt", ErrUnavailable)
+	default:
+		return 0, fmt.Errorf("request %s: OSStatus %d", rightExecute, status)
+	}
+}
+
+// execute runs the tool with the right in hand and waits for it by reading the pipe
+// it is given until the tool closes it.
+//
+// AuthorizationExecuteWithPrivileges reports no exit status and does not say what
+// process it started, which is why the one-shot says so itself: what it prints is
+// the only evidence that the change was applied.
+func execute(ctx context.Context, authorization uintptr, self string, args []string) error {
+	var pinner runtime.Pinner
+	defer pinner.Unpin()
+
+	argv := make([]uintptr, 0, len(args)+1)
+	for _, arg := range args {
+		argv = append(argv, uintptr(unsafe.Pointer(cString(&pinner, arg))))
+	}
+	argv = append(argv, 0)
+	pinner.Pin(&argv[0])
+
+	var pipe uintptr
+	status := authorizationExecuteWithPrivileges(authorization, self, flagDefaults, &argv[0], &pipe)
+	switch status {
+	case errAuthorizationSuccess:
+	case errAuthorizationCanceled:
+		return ErrDeclined
+	case errAuthorizationToolExecuteFailure, errAuthorizationToolEnvironmentError:
+		// The right was granted and the tool still did not start. Nothing the user
+		// can do about it from here, so point them at the command instead.
+		return fmt.Errorf("%w: the system would not run %s elevated (OSStatus %d)", ErrUnavailable, self, status)
+	default:
+		return fmt.Errorf("run %s elevated: OSStatus %d", self, status)
+	}
+
+	out, err := readPipe(ctx, pipe)
+	if err != nil {
+		return err
+	}
+	return checkApplied(out)
+}
+
+// checkApplied reads the one-shot's report, which stands in for the exit status
+// there is no way to ask for here. A run that said nothing did not apply the
+// change, whatever else went on.
+func checkApplied(out string) error {
+	if !strings.Contains(out, AppliedMarker) {
+		return fmt.Errorf("elevated netbird did not report the change as applied: %s", firstLine(out))
+	}
+	return nil
+}
+
+// readPipe drains the tool's output, which ends when the tool exits and is
+// therefore also how we wait for it.
+func readPipe(ctx context.Context, pipe uintptr) (string, error) {
+	if pipe == 0 {
+		return "", nil
+	}
+	defer fclose(pipe)
+
+	fd := int(fileno(pipe))
+	if fd < 0 {
+		return "", nil
+	}
+
+	var out strings.Builder
+	buf := make([]byte, 4096)
+	for {
+		if err := ctx.Err(); err != nil {
+			return out.String(), err
+		}
+		n, err := syscall.Read(fd, buf)
+		if n > 0 {
+			out.Write(buf[:n])
+		}
+		switch {
+		case errors.Is(err, syscall.EINTR):
+			// A signal landed mid-read, which says nothing about the tool.
+			continue
+		case err != nil:
+			log.Debugf("read the elevated process's output: %v", err)
+			return out.String(), nil
+		case n <= 0:
+			// End of file: the tool closed the pipe, which is how it exiting
+			// reaches us.
+			return out.String(), nil
+		}
+	}
+}
+
+// itemSet builds an AuthorizationItemSet over items, pinned for the call.
+func itemSet(pinner *runtime.Pinner, items ...authorizationItem) *authorizationItemSet {
+	pinner.Pin(&items[0])
+	set := &authorizationItemSet{count: uint32(len(items)), items: &items[0]}
+	pinner.Pin(set)
+	return set
+}
+
+// promptItem is the environment entry carrying our sentence for the dialog.
+func promptItem(pinner *runtime.Pinner) authorizationItem {
+	value := []byte(promptText)
+	pinner.Pin(&value[0])
+	return authorizationItem{
+		name:        cString(pinner, promptKey),
+		valueLength: uintptr(len(value)),
+		value:       unsafe.Pointer(&value[0]),
+	}
+}
+
+// cString returns a NUL-terminated copy of s, pinned so the C side may hold it for
+// the duration of the call.
+func cString(pinner *runtime.Pinner, s string) *byte {
+	b := append([]byte(s), 0)
+	pinner.Pin(&b[0])
+	return &b[0]
+}
@@ -0,0 +1,111 @@
+package elevate
+
+import (
+	"errors"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// The framework has to load and the symbols have to resolve, or nothing else here
+// means anything.
+func TestSecurityFrameworkLoads(t *testing.T) {
+	require.NoError(t, load(), "Security.framework must open")
+
+	for name, fn := range map[string]any{
+		"AuthorizationCreate":                authorizationCreate,
+		"AuthorizationExecuteWithPrivileges": authorizationExecuteWithPrivileges,
+		"AuthorizationFree":                  authorizationFree,
+		"fileno":                             fileno,
+		"fclose":                             fclose,
+	} {
+		assert.NotNil(t, fn, "%s must resolve", name)
+	}
+}
+
+// A request with no interaction allowed exercises the whole call — the rights and
+// environment structs, and the OSStatus that comes back — without a dialog anybody
+// has to answer. What the system decides is its business; that it decides at all is
+// what this asserts.
+func TestAuthorizationCreateWithoutInteraction(t *testing.T) {
+	if err := load(); err != nil {
+		t.Skipf("Security.framework did not open: %v", err)
+	}
+
+	var pinner runtime.Pinner
+	defer pinner.Unpin()
+
+	rights := itemSet(&pinner, authorizationItem{name: cString(&pinner, rightExecute)})
+	environment := itemSet(&pinner, promptItem(&pinner))
+	require.EqualValues(t, 1, rights.count, "the rights struct layout must match the C one")
+
+	var authorization uintptr
+	status := authorizationCreate(rights, environment, flagDefaults|flagExtendRights, &authorization)
+
+	switch status {
+	case errAuthorizationSuccess:
+		// Credentials were already cached for this session.
+		authorizationFree(authorization, flagDestroyRights)
+	case errAuthorizationDenied, errAuthorizationInteractionNotAllowed:
+		// The expected answers when nobody may be asked.
+	default:
+		require.Failf(t, "unknown OSStatus", "AuthorizationCreate returned %d, want a status we recognise", status)
+	}
+}
+
+// Asking with a right nobody has must not be mistaken for a declined prompt: the
+// caller would report nothing at all.
+func TestAuthorizeUnknownRightIsNotDeclined(t *testing.T) {
+	if err := load(); err != nil {
+		t.Skipf("Security.framework did not open: %v", err)
+	}
+
+	var pinner runtime.Pinner
+	defer pinner.Unpin()
+
+	rights := itemSet(&pinner, authorizationItem{name: cString(&pinner, "io.netbird.right.that.does.not.exist")})
+
+	var authorization uintptr
+	status := authorizationCreate(rights, nil, flagDefaults|flagExtendRights, &authorization)
+	if status == errAuthorizationSuccess {
+		authorizationFree(authorization, flagDestroyRights)
+	}
+	assert.NotEqual(t, int32(errAuthorizationSuccess), status, "a right that does not exist must not be granted")
+}
+
+func TestMechanismAvailable(t *testing.T) {
+	assert.True(t, mechanismAvailable(), "the trampoline exists on every macOS")
+}
+
+// The one-shot's report is what stands in for an exit status here, so a run that
+// says nothing must not read as success.
+func TestCheckApplied(t *testing.T) {
+	require.NoError(t, checkApplied(AppliedMarker+"\n"), "the report the one-shot prints")
+	require.NoError(t, checkApplied("some warning\n"+AppliedMarker+"\n"), "the report after other output")
+
+	assert.Error(t, checkApplied(""), "a run that printed nothing did not apply the change")
+	assert.Error(t, checkApplied("dyld: library not loaded\n"), "output that is not the report")
+}
+
+// A panic out of the FFI layer has to reach the caller as "no mechanism", which is
+// the outcome that offers the user the command instead of taking the window down.
+func TestGuardTurnsAPanicIntoUnavailable(t *testing.T) {
+	err := guard("pretending to call something", func() error {
+		panic("purego: signature it cannot map")
+	})
+
+	require.ErrorIs(t, err, ErrUnavailable, "a panic must read as a missing mechanism")
+	assert.Contains(t, err.Error(), "pretending to call something", "what panicked")
+}
+
+// guard wraps every darwin path, so what a caller switches on has to survive it.
+func TestGuardPassesErrorsThrough(t *testing.T) {
+	sentinel := errors.New("the call itself failed")
+	assert.ErrorIs(t, guard("calling", func() error { return sentinel }), sentinel,
+		"the error it was given")
+	assert.ErrorIs(t, guard("calling", func() error { return ErrDeclined }), ErrDeclined,
+		"a declined prompt stays declined")
+	assert.NoError(t, guard("calling", func() error { return nil }), "a call that worked")
+}
@@ -0,0 +1,117 @@
+//go:build linux
+
+package elevate
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"strings"
+)
+
+// pkexec exit codes that are about the authorization rather than about the program
+// we asked it to run. The manual page reserves both.
+const (
+	// exitDismissed is returned when the user dismissed the authentication
+	// dialog.
+	exitDismissed = 126
+	// exitNotAuthorized is returned when the authorization was not obtained. That
+	// covers the user saying no as well as pkexec having had nobody to ask: see
+	// noAgentMarkers.
+	exitNotAuthorized = 127
+)
+
+// exitNotAuthorized covers three different endings that only pkexec's own words
+// tell apart, so they are matched here. Read with LC_ALL=C so the words are the
+// ones written below.
+//
+// refusedMarker is a refusal: the user said no, gave up on the password, or holds
+// an account that may not elevate at all.
+const refusedMarker = "Not authorized"
+
+// noAgentMarkers say pkexec had no way to ask: no agent registered for the
+// session, and no controlling terminal for the textual agent it falls back to.
+var noAgentMarkers = []string{"authentication agent", "controlling terminal"}
+
+// run asks polkit to run self as root. pkexec hands the request to the session's
+// polkit agent, which is what prompts and what collects any password; we see only
+// its verdict.
+//
+// The environment is otherwise deliberately not passed through: pkexec clears it
+// bar a small allowlist, and the one-shot needs nothing from it.
+func run(ctx context.Context, self string, args []string) error {
+	pkexec, err := exec.LookPath("pkexec")
+	if err != nil {
+		return fmt.Errorf("%w: pkexec is not installed", ErrUnavailable)
+	}
+
+	cmd := exec.CommandContext(ctx, pkexec, append([]string{self}, args...)...)
+	// C locale so pkexec's own diagnostics are the ones noAgentMarkers knows.
+	cmd.Env = append(os.Environ(), "LC_ALL=C")
+	var stderr strings.Builder
+	cmd.Stderr = &stderr
+	// The one-shot reports itself on stdout for macOS's sake, where there is no
+	// exit status to read. Here there is one, so that line is noise.
+	cmd.Stdout = io.Discard
+
+	err = cmd.Run()
+	if err == nil {
+		return nil
+	}
+
+	var exitErr *exec.ExitError
+	if !errors.As(err, &exitErr) {
+		return fmt.Errorf("run pkexec: %w", err)
+	}
+
+	// Matched against everything pkexec said, reported as one line: a complaint
+	// that is not the first thing printed still has to be recognised, and reading
+	// it as a refusal would swallow it.
+	full := stderr.String()
+	out := firstLine(full)
+
+	switch exitErr.ExitCode() {
+	case exitDismissed:
+		return ErrDeclined
+	case exitNotAuthorized:
+		return notAuthorized(full, out)
+	default:
+		return fmt.Errorf("elevated netbird exited with %d: %s", exitErr.ExitCode(), out)
+	}
+}
+
+// notAuthorized sorts out the three endings pkexec reports as exitNotAuthorized.
+//
+// It also returns that code when the authorization succeeded and it then could
+// not run the program, so a refusal has to be recognised rather than assumed:
+// reading every one of these as "the user said no" would revert the control in
+// silence on a host where elevation is broken.
+func notAuthorized(full, out string) error {
+	switch {
+	case hasAny(full, noAgentMarkers):
+		return fmt.Errorf("%w: polkit had no way to ask: %s", ErrUnavailable, out)
+	case out == noOutput, strings.Contains(full, refusedMarker):
+		// The user said no, which needs no message; that an account barred from
+		// elevating altogether lands here too is why the reason is kept.
+		return fmt.Errorf("%w: %s", ErrDeclined, out)
+	default:
+		return fmt.Errorf("pkexec could not run elevated netbird: %s", out)
+	}
+}
+
+func hasAny(s string, markers []string) bool {
+	for _, marker := range markers {
+		if strings.Contains(s, marker) {
+			return true
+		}
+	}
+	return false
+}
+
+func mechanismAvailable() bool {
+	_, err := exec.LookPath("pkexec")
+	return err == nil
+}
@@ -0,0 +1,110 @@
+//go:build linux
+
+package elevate
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// fakePkexec puts a pkexec on PATH that exits with the given code, so the
+// mapping from polkit's exit codes onto our errors can be exercised without a
+// polkit agent.
+func fakePkexec(t *testing.T, exitCode int, stderr string) {
+	t.Helper()
+
+	dir := t.TempDir()
+	script := fmt.Sprintf("#!/bin/sh\necho %s >&2\nexit %d\n", shellQuote(stderr), exitCode)
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "pkexec"), []byte(script), 0o700), "write the fake pkexec")
+	t.Setenv("PATH", dir)
+}
+
+func shellQuote(s string) string {
+	return "'" + strings.ReplaceAll(s, "'", `'\''`) + "'"
+}
+
+func TestRunMapsPkexecExitCodes(t *testing.T) {
+	tests := []struct {
+		name     string
+		exitCode int
+		stderr   string
+		wantErr  error
+	}{
+		{name: "applied", exitCode: 0},
+		{
+			name:     "dialog dismissed",
+			exitCode: exitDismissed,
+			stderr:   "Error executing command as another user: Request dismissed",
+			wantErr:  ErrDeclined,
+		},
+		{
+			// What a graphical agent reports for a cancelled prompt. Not a
+			// failure: the user was asked and answered.
+			name:     "prompt cancelled",
+			exitCode: exitNotAuthorized,
+			stderr:   "Error executing command as another user: Not authorized",
+			wantErr:  ErrDeclined,
+		},
+		{
+			// The same status, but pkexec never got to ask anybody.
+			name:     "no agent and no terminal to fall back on",
+			exitCode: exitNotAuthorized,
+			stderr:   "Error creating textual authentication agent: Error opening current controlling terminal for the process (`/dev/tty'): No such device or address",
+			wantErr:  ErrUnavailable,
+		},
+		{
+			// And the same status again once the authorization succeeded and
+			// pkexec could not run what it had been authorized to run. Reading
+			// that as a refusal would revert the control in silence on a host
+			// where elevation is broken.
+			name:     "authorized but not runnable",
+			exitCode: exitNotAuthorized,
+			stderr:   "Error executing command as another user: No such file or directory",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fakePkexec(t, tt.exitCode, tt.stderr)
+
+			err := run(context.Background(), "/nonexistent/netbird-ui", []string{"--flag"})
+			switch {
+			case tt.wantErr != nil:
+				require.ErrorIs(t, err, tt.wantErr, "exit %d said %q", tt.exitCode, tt.stderr)
+			case tt.exitCode == 0:
+				require.NoError(t, err, "a pkexec that exited cleanly applied the change")
+			default:
+				require.Error(t, err, "exit %d said %q", tt.exitCode, tt.stderr)
+				assert.NotErrorIs(t, err, ErrDeclined, "not the user's answer")
+				assert.NotErrorIs(t, err, ErrUnavailable, "not a missing mechanism")
+			}
+		})
+	}
+}
+
+// An exit code that is not polkit's is the one-shot's own failure, and has to
+// stay distinguishable from a declined prompt: the caller reports it.
+func TestRunReportsOneShotFailure(t *testing.T) {
+	fakePkexec(t, 3, "the one-shot said no")
+
+	err := run(context.Background(), "/nonexistent/netbird-ui", nil)
+
+	require.Error(t, err, "a one-shot that failed is not a prompt that was answered")
+	assert.NotErrorIs(t, err, ErrDeclined, "not the user's answer")
+	assert.NotErrorIs(t, err, ErrUnavailable, "not a missing mechanism")
+}
+
+func TestRunWithoutPkexecIsUnavailable(t *testing.T) {
+	t.Setenv("PATH", t.TempDir())
+
+	err := run(context.Background(), "/nonexistent/netbird-ui", nil)
+	require.ErrorIs(t, err, ErrUnavailable, "no pkexec means no mechanism")
+	assert.False(t, mechanismAvailable(), "mechanismAvailable without pkexec on PATH")
+}
@@ -0,0 +1,19 @@
+//go:build !windows && !darwin && !linux
+
+package elevate
+
+import "context"
+
+// run reports that this platform has no elevation prompt to drive.
+//
+// The desktop app is the only caller and is not built for any of these: mobile
+// and WASM have no local user to ask, and the FreeBSD client ships without a UI.
+// pkexec would be the mechanism there, and run_unix.go is what to widen if that
+// changes.
+func run(context.Context, string, []string) error {
+	return ErrUnavailable
+}
+
+func mechanismAvailable() bool {
+	return false
+}
@@ -0,0 +1,187 @@
+package elevate
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"runtime"
+	"unsafe"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+)
+
+const (
+	// seeMaskNoCloseProcess keeps the started process's handle open in
+	// hProcess so we can wait for it.
+	seeMaskNoCloseProcess = 0x00000040
+	// seeMaskNoAsync makes ShellExecuteExW finish its work before returning,
+	// which it must when the calling thread does not pump messages.
+	seeMaskNoAsync = 0x00000100
+	// seeMaskFlagNoUI suppresses the shell's own error dialogs; the UAC consent
+	// dialog is not one of them and still appears.
+	seeMaskFlagNoUI = 0x00000400
+
+	// swHide: the one-shot has no window to show.
+	swHide = 0
+)
+
+// shellExecuteInfoW mirrors SHELLEXECUTEINFOW. The field order and Go's own
+// padding match the C layout on both 386 and amd64.
+type shellExecuteInfoW struct {
+	cbSize         uint32
+	fMask          uint32
+	hwnd           windows.HWND
+	lpVerb         *uint16
+	lpFile         *uint16
+	lpParameters   *uint16
+	lpDirectory    *uint16
+	nShow          int32
+	hInstApp       windows.Handle
+	lpIDList       uintptr
+	lpClass        *uint16
+	hkeyClass      windows.Handle
+	dwHotKey       uint32
+	hIconOrMonitor windows.Handle
+	hProcess       windows.Handle
+}
+
+var (
+	shell32            = windows.NewLazySystemDLL("shell32.dll")
+	procShellExecuteEx = shell32.NewProc("ShellExecuteExW")
+)
+
+// run starts self elevated with the "runas" verb, which is what raises the UAC
+// consent dialog, and waits for it to finish. Windows decides whether consent is
+// enough or an administrator's credentials are needed, and collects them itself.
+func run(ctx context.Context, self string, args []string) error {
+	verb, err := windows.UTF16PtrFromString("runas")
+	if err != nil {
+		return fmt.Errorf("encode verb: %w", err)
+	}
+	file, err := windows.UTF16PtrFromString(self)
+	if err != nil {
+		return fmt.Errorf("encode %s: %w", self, err)
+	}
+	params, err := windows.UTF16PtrFromString(windows.ComposeCommandLine(args))
+	if err != nil {
+		return fmt.Errorf("encode arguments: %w", err)
+	}
+
+	info := shellExecuteInfoW{
+		fMask:        seeMaskNoCloseProcess | seeMaskNoAsync | seeMaskFlagNoUI,
+		hwnd:         ownerWindow(),
+		lpVerb:       verb,
+		lpFile:       file,
+		lpParameters: params,
+		nShow:        swHide,
+	}
+	info.cbSize = uint32(unsafe.Sizeof(info))
+
+	process, err := shellExecute(&info)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err := windows.CloseHandle(process); err != nil {
+			log.Debugf("close elevated process handle: %v", err)
+		}
+	}()
+
+	return waitForProcess(ctx, process)
+}
+
+// shellExecute performs the call itself. ShellExecuteExW wants COM initialised on
+// the calling thread, so the goroutine is pinned to one for the duration and COM
+// is set up on it; an "already initialised, different mode" answer is fine,
+// because then somebody else has done it for us.
+func shellExecute(info *shellExecuteInfoW) (windows.Handle, error) {
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+
+	switch err := windows.CoInitializeEx(0, windows.COINIT_APARTMENTTHREADED); {
+	case err == nil, isHResult(err, windows.S_FALSE):
+		// Ours, or already initialised in the same mode: either way this call
+		// counts and has to be balanced.
+		defer windows.CoUninitialize()
+	case isHResult(err, windows.RPC_E_CHANGED_MODE):
+		// The thread is already in the other apartment model. ShellExecuteExW
+		// works there too, and there is nothing of ours to balance.
+	default:
+		return 0, fmt.Errorf("initialise COM: %w", err)
+	}
+
+	ret, _, lastErr := procShellExecuteEx.Call(uintptr(unsafe.Pointer(info)))
+	if ret != 0 {
+		return info.hProcess, nil
+	}
+
+	if errors.Is(lastErr, windows.ERROR_CANCELLED) {
+		return 0, ErrDeclined
+	}
+	return 0, fmt.Errorf("run elevated: %w", lastErr)
+}
+
+// ownerWindow returns this process's foreground window, and 0 when the window in
+// front belongs to somebody else or cannot be attributed. ShellExecuteExW takes it
+// as the parent for the UI it raises, which is what keeps the consent dialog in
+// front of the window the user was just clicking in instead of behind it. It is
+// also what a remote-desktop session needs to place the dialog at all when the
+// secure desktop is switched off.
+func ownerWindow() windows.HWND {
+	hwnd := windows.GetForegroundWindow()
+	if hwnd == 0 {
+		return 0
+	}
+
+	var pid uint32
+	if _, err := windows.GetWindowThreadProcessId(hwnd, &pid); err != nil {
+		log.Debugf("cannot attribute the foreground window, raising the prompt without an owner: %v", err)
+		return 0
+	}
+	if pid != windows.GetCurrentProcessId() {
+		return 0
+	}
+	return hwnd
+}
+
+// isHResult reports whether err carries the given HRESULT. CoInitializeEx
+// returns its HRESULT as an Errno, so the comparison is on the raw value.
+func isHResult(err error, hresult windows.Handle) bool {
+	var errno windows.Errno
+	return errors.As(err, &errno) && uintptr(errno) == uintptr(hresult)
+}
+
+func waitForProcess(ctx context.Context, process windows.Handle) error {
+	// The wait is interruptible so a cancelled context stops us waiting on a
+	// consent dialog nobody is going to answer. The elevated process is not
+	// ours to kill, and it either applies the change or does not.
+	for {
+		event, err := windows.WaitForSingleObject(process, 250)
+		if err != nil {
+			return fmt.Errorf("wait for the elevated process: %w", err)
+		}
+		if event == uint32(windows.WAIT_OBJECT_0) {
+			break
+		}
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+	}
+
+	var code uint32
+	if err := windows.GetExitCodeProcess(process, &code); err != nil {
+		return fmt.Errorf("read the elevated process's exit code: %w", err)
+	}
+	if code != 0 {
+		return fmt.Errorf("elevated netbird exited with %d", code)
+	}
+	return nil
+}
+
+// mechanismAvailable is true on Windows: UAC prompts for consent when the user
+// is an administrator and for an administrator's credentials when they are not,
+// so there is always something to ask.
+func mechanismAvailable() bool {
+	return true
+}
@@ -0,0 +1,40 @@
+package elevate
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+// trustedSelf returns the path of this executable, provided it is one we are
+// willing to have run as root.
+//
+// The check is what keeps elevation from becoming a way to launder someone
+// else's code into a root process: the user consents to NetBird being elevated,
+// having been shown NetBird's name, so what runs must be the file NetBird was
+// installed as and not something a third party could have swapped for it. An
+// executable only its owner can write is that; anything wider is refused, and
+// the caller falls back to showing the command instead.
+//
+// The owner writing to their own executable is not part of that threat: code
+// running as the user can already prompt them for anything, and could just as
+// well ask them to run the command by hand. What matters is that no *other*
+// unprivileged account can reach it.
+func trustedSelf() (string, error) {
+	exe, err := os.Executable()
+	if err != nil {
+		return "", fmt.Errorf("locate this executable: %w", err)
+	}
+
+	// Resolve symlinks so the checks below apply to the file that would actually
+	// be executed, not to a link somebody else may control.
+	resolved, err := filepath.EvalSymlinks(exe)
+	if err != nil {
+		return "", fmt.Errorf("resolve %s: %w", exe, err)
+	}
+
+	if err := checkOnlyOwnerWritable(resolved); err != nil {
+		return "", fmt.Errorf("%w: %s cannot be trusted to run as root: %w", ErrUnavailable, resolved, err)
+	}
+	return resolved, nil
+}
@@ -0,0 +1,10 @@
+package elevate
+
+// adminWriteGIDs are the groups whose write access to an executable does not
+// widen who could authorize elevating it.
+//
+// macOS installs applications as root:admin, mode 0775, /Applications included,
+// so requiring owner-only write would reject every normal install. Group admin
+// (gid 80) is exactly the set of accounts that can answer the authentication
+// dialog, so its write access grants nothing the prompt would not.
+var adminWriteGIDs = []uint32{0, 80}
@@ -0,0 +1,9 @@
+//go:build !windows && !darwin
+
+package elevate
+
+// adminWriteGIDs are the groups whose write access to an executable does not
+// widen who could authorize elevating it. Only root's own group qualifies here:
+// a distribution installs into root-owned directories, and there is no
+// system-wide administrators group that both writes them and answers polkit.
+var adminWriteGIDs = []uint32{0}
@@ -0,0 +1,119 @@
+//go:build !windows
+
+package elevate
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"syscall"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/getent"
+)
+
+// checkOnlyOwnerWritable reports an error unless path, and every directory leading
+// to it, is owned by either root or this user and writable by nobody who could not
+// already act as its owner. A writable directory is as good as a writable file,
+// since anything in it can be replaced, so the whole chain is checked.
+func checkOnlyOwnerWritable(path string) error {
+	self := uint32(os.Getuid())
+
+	for dir := path; ; dir = filepath.Dir(dir) {
+		info, err := os.Lstat(dir)
+		if err != nil {
+			return fmt.Errorf("stat %s: %w", dir, err)
+		}
+
+		stat, ok := info.Sys().(*syscall.Stat_t)
+		if !ok {
+			return errors.New("file ownership is unavailable on this platform")
+		}
+		if stat.Uid != 0 && stat.Uid != self {
+			return fmt.Errorf("%s is owned by uid %d, neither root nor this user", dir, stat.Uid)
+		}
+
+		if err := checkWriteBits(dir, info, stat.Uid, stat.Gid); err != nil {
+			return err
+		}
+
+		if parent := filepath.Dir(dir); parent == dir {
+			return nil
+		}
+	}
+}
+
+func checkWriteBits(path string, info os.FileInfo, uid, gid uint32) error {
+	// On a directory the sticky bit stands in for the write bits: whoever may
+	// write there still cannot replace an entry they do not own, which is the
+	// only thing that would matter to us. /tmp is the usual example.
+	sticky := info.IsDir() && info.Mode()&os.ModeSticky != 0
+
+	return writeBitsAllow(path, info.Mode().Perm(), sticky, groupWriteAllowed(uid, gid))
+}
+
+// writeBitsAllow decides on the permission bits alone, given whether the group's
+// write access has been vouched for.
+func writeBitsAllow(path string, perm os.FileMode, sticky, groupAllowed bool) error {
+	if sticky {
+		return nil
+	}
+	if perm&0o020 != 0 && !groupAllowed {
+		return fmt.Errorf("%s is writable by a group with members other than its owner (%v)", path, perm)
+	}
+	if perm&0o002 != 0 {
+		return fmt.Errorf("%s is world-writable (%v)", path, perm)
+	}
+	return nil
+}
+
+// groupWriteAllowed reports whether a group's write access to a file owned by uid
+// puts it in reach of anyone who could not already act as that owner.
+//
+// Two ways it does not. A group in adminWriteGIDs holds the accounts that can
+// answer the elevation prompt anyway. And a user private group is how Debian,
+// Ubuntu and Fedora ship: their umask of 002 makes a home directory and
+// everything built in it group-writable, so refusing that would refuse every
+// build not installed from a package.
+func groupWriteAllowed(uid, gid uint32) bool {
+	if slices.Contains(adminWriteGIDs, gid) {
+		return true
+	}
+
+	group, err := getent.LookupGroupID(strconv.FormatUint(uint64(gid), 10))
+	if err != nil {
+		log.Debugf("cannot look up group %d, treating it as shared: %v", gid, err)
+		return false
+	}
+	owner, err := getent.LookupUserID(strconv.FormatUint(uint64(uid), 10))
+	if err != nil {
+		log.Debugf("cannot look up uid %d, treating its group as shared: %v", uid, err)
+		return false
+	}
+
+	if group.Name != owner.Username {
+		return false
+	}
+	return !groupHasOtherMembers(group.Name, owner.Username)
+}
+
+// groupHasOtherMembers reports whether the group lists a member besides owner.
+//
+// Sharing the owner's name is what a user private group is recognised by, and it
+// says nothing about who is in it: a group that has since gained a member is
+// still named that way, and that member can write whatever the group can. So the
+// membership is read rather than assumed. A group whose members cannot be
+// listed, because no source on this host describes it, is treated as shared:
+// the name alone cannot vouch for who writes through it.
+func groupHasOtherMembers(name, owner string) bool {
+	members, err := getent.GroupMembers(name)
+	if err != nil {
+		log.Debugf("cannot list the members of group %q, treating it as shared: %v", name, err)
+		return true
+	}
+	return slices.ContainsFunc(members, func(member string) bool { return member != owner })
+}
@@ -0,0 +1,148 @@
+//go:build !windows
+
+package elevate
+
+import (
+	"os"
+	"os/user"
+	"path/filepath"
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// ownerOnlyDir is t.TempDir() with the write bits tightened. testing creates its
+// numbered directory with 0777 minus the umask, so under the common 002 umask it
+// is group-writable and would fail the check under test on its own.
+func ownerOnlyDir(t *testing.T) string {
+	t.Helper()
+	dir := t.TempDir()
+	require.NoError(t, os.Chmod(dir, 0o755), "tighten the temporary directory")
+	return dir
+}
+
+// writeExecutable creates a plain executable file, the shape trustedSelf checks.
+func writeExecutable(t *testing.T, dir string) string {
+	t.Helper()
+	path := filepath.Join(dir, "netbird-ui")
+	require.NoError(t, os.WriteFile(path, []byte("#!/bin/sh\n"), 0o755), "write the executable")
+	require.NoError(t, os.Chmod(path, 0o755), "set the executable's mode")
+	return path
+}
+
+func TestCheckOnlyOwnerWritableAcceptsOwnerOnly(t *testing.T) {
+	err := checkOnlyOwnerWritable(writeExecutable(t, ownerOnlyDir(t)))
+	assert.NoError(t, err, "an owner-only writable executable is trustworthy")
+}
+
+func TestCheckOnlyOwnerWritableRejectsWorldWritableFile(t *testing.T) {
+	path := writeExecutable(t, ownerOnlyDir(t))
+	require.NoError(t, os.Chmod(path, 0o777), "make the executable world-writable")
+
+	assert.Error(t, checkOnlyOwnerWritable(path), "a world-writable executable must be refused")
+}
+
+// The permission policy on its own, without a filesystem to arrange: whether the
+// group has been vouched for is the only thing that makes group write acceptable.
+func TestWriteBitsAllow(t *testing.T) {
+	tests := []struct {
+		name         string
+		perm         os.FileMode
+		sticky       bool
+		groupAllowed bool
+		wantErr      bool
+	}{
+		{name: "owner only", perm: 0o755},
+		{name: "group write in a private group", perm: 0o775, groupAllowed: true},
+		{name: "group write in a shared group", perm: 0o775, wantErr: true},
+		{name: "world write", perm: 0o777, groupAllowed: true, wantErr: true},
+		{name: "world write on a sticky directory", perm: 0o777, sticky: true},
+		{name: "group write on a sticky directory", perm: 0o775, sticky: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := writeBitsAllow("/path", tt.perm, tt.sticky, tt.groupAllowed)
+			if tt.wantErr {
+				assert.Error(t, err, "perm %v, sticky %v, group allowed %v", tt.perm, tt.sticky, tt.groupAllowed)
+				return
+			}
+			assert.NoError(t, err, "perm %v, sticky %v, group allowed %v", tt.perm, tt.sticky, tt.groupAllowed)
+		})
+	}
+}
+
+// A build under a home directory on a distribution with a 002 umask, which is what
+// a locally built or tarball-installed binary looks like. Its group has no members
+// but its owner, so it is as good as owner-only.
+//
+// Whether this host is such a distribution is read from the environment rather than
+// from groupWriteAllowed: asking the function under test whether to run would let
+// it skip its own coverage away if it regressed to refusing everything.
+func TestCheckOnlyOwnerWritableAcceptsOwnPrivateGroup(t *testing.T) {
+	requirePrivatePrimaryGroup(t)
+
+	dir := ownerOnlyDir(t)
+	path := writeExecutable(t, dir)
+	require.NoError(t, os.Chmod(dir, 0o775), "make the directory group-writable")
+	require.NoError(t, os.Chmod(path, 0o775), "make the executable group-writable")
+
+	err := checkOnlyOwnerWritable(path)
+	assert.NoError(t, err, "group write in the owner's own private group reaches nobody else")
+}
+
+// A group whose membership no source can answer for is treated as shared: the
+// private-group allowance must not stand on a name nobody can vouch for. The
+// membership listing itself lives in the getent package and is tested there.
+func TestGroupHasOtherMembersRejectsAnUnknownGroup(t *testing.T) {
+	assert.True(t, groupHasOtherMembers("nonexistent_group_xyzzy_12345", "vma"),
+		"a group no source describes")
+}
+
+// A writable directory is as good as a writable file: whoever can write the
+// directory can put a different binary at the same path.
+func TestCheckOnlyOwnerWritableRejectsWritableDirectory(t *testing.T) {
+	dir := filepath.Join(ownerOnlyDir(t), "bin")
+	require.NoError(t, os.Mkdir(dir, 0o755), "create the directory")
+	path := writeExecutable(t, dir)
+	require.NoError(t, os.Chmod(dir, 0o777), "make the directory world-writable")
+
+	assert.Error(t, checkOnlyOwnerWritable(path), "an executable in a world-writable directory must be refused")
+}
+
+// A sticky world-writable directory is exempt: the sticky bit is what stops one
+// user replacing another's entries. /tmp is why this matters.
+func TestCheckOnlyOwnerWritableAcceptsStickyDirectory(t *testing.T) {
+	dir := filepath.Join(ownerOnlyDir(t), "sticky")
+	require.NoError(t, os.Mkdir(dir, 0o755), "create the directory")
+	path := writeExecutable(t, dir)
+	require.NoError(t, os.Chmod(dir, 0o777|os.ModeSticky), "make the directory sticky and world-writable")
+
+	err := checkOnlyOwnerWritable(path)
+	assert.NoError(t, err, "the sticky bit stops another user replacing the executable")
+}
+
+func TestCheckOnlyOwnerWritableRejectsMissingFile(t *testing.T) {
+	err := checkOnlyOwnerWritable(filepath.Join(ownerOnlyDir(t), "absent"))
+	assert.Error(t, err, "an executable that is not there must be refused")
+}
+
+// requirePrivatePrimaryGroup skips unless this user's primary group is their own,
+// which is what the user-private-group allowance is about.
+func requirePrivatePrimaryGroup(t *testing.T) {
+	t.Helper()
+
+	self, err := user.Current()
+	require.NoError(t, err, "look up the test user")
+	group, err := user.LookupGroupId(strconv.Itoa(os.Getgid()))
+	require.NoError(t, err, "look up the test user's primary group")
+
+	if group.Name != self.Username {
+		t.Skipf("the test user's primary group is %q, not their own, so there is nothing to assert here", group.Name)
+	}
+	if groupHasOtherMembers(group.Name, self.Username) {
+		t.Skipf("group %q has other members, so it is not a private group", group.Name)
+	}
+}
@@ -0,0 +1,215 @@
+package elevate
+
+import (
+	"errors"
+	"fmt"
+	"path/filepath"
+	"slices"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+const (
+	// fileDeleteChild is FILE_DELETE_CHILD, which x/sys does not define: the
+	// right to delete an entry of a directory without holding DELETE on it.
+	fileDeleteChild = 0x00000040
+
+	// accessAllowedCallbackACEType is an allow ACE with a condition appended to
+	// the ACCESS_ALLOWED_ACE layout, so its trustee is still at SidStart.
+	accessAllowedCallbackACEType = 0x9
+
+	// The allow ACE types that carry object GUIDs ahead of the trustee, so the
+	// SID is not at SidStart. They occur on directory-service objects rather
+	// than files, and are refused rather than skipped: see aceTrustee.
+	accessAllowedObjectACEType         = 0x5
+	accessAllowedCallbackObjectACEType = 0xB
+)
+
+// fileWriteAccess are the rights that let a trustee rewrite or replace a file,
+// or take it over and then do so.
+const fileWriteAccess = windows.FILE_WRITE_DATA | windows.FILE_APPEND_DATA |
+	windows.DELETE | windows.WRITE_DAC | windows.WRITE_OWNER |
+	windows.GENERIC_WRITE | windows.GENERIC_ALL
+
+// dirWriteAccess are the rights over a directory that let a trustee replace an
+// entry somebody else owns. Creating a new entry is not one of them, which is
+// what the Unix sticky bit says in one bit: the root of every volume grants
+// BUILTIN\Users the right to add directories under it, and that reaches nothing
+// already there.
+const dirWriteAccess = fileDeleteChild | windows.DELETE |
+	windows.WRITE_DAC | windows.WRITE_OWNER | windows.GENERIC_ALL
+
+// trustedInstallerSID owns much of what Windows itself installs. x/sys has no
+// well-known constant for it.
+const trustedInstallerSID = "S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464"
+
+// checkOnlyOwnerWritable reports an error unless path, and every directory
+// leading to it, is owned by an account that can elevate (or by this user) and
+// grants write access to nobody else. A writable directory is as good as a
+// writable file, since an entry in it can be replaced, so the whole chain is
+// checked.
+func checkOnlyOwnerWritable(path string) error {
+	owners, err := trustedOwners()
+	if err != nil {
+		return err
+	}
+	writers, err := trustedWriters(owners)
+	if err != nil {
+		return err
+	}
+
+	writeAccess := windows.ACCESS_MASK(fileWriteAccess)
+	for target := path; ; target = filepath.Dir(target) {
+		if err := checkSecurity(target, writeAccess, owners, writers); err != nil {
+			return err
+		}
+		if parent := filepath.Dir(target); parent == target {
+			return nil
+		}
+		writeAccess = dirWriteAccess
+	}
+}
+
+// trustedOwners are the accounts we accept as the owner of the executable and of
+// the directories above it: the ones that can already answer the UAC prompt,
+// plus this user, whose own executable is theirs to write. Code running as the
+// user could prompt them for anything anyway; what matters is that no *other*
+// unprivileged account can reach it.
+func trustedOwners() ([]*windows.SID, error) {
+	self, err := currentUserSID()
+	if err != nil {
+		return nil, err
+	}
+
+	owners := []*windows.SID{self}
+	for _, wellKnown := range []windows.WELL_KNOWN_SID_TYPE{
+		windows.WinLocalSystemSid,
+		windows.WinBuiltinAdministratorsSid,
+	} {
+		sid, err := windows.CreateWellKnownSid(wellKnown)
+		if err != nil {
+			return nil, fmt.Errorf("build well-known SID %d: %w", wellKnown, err)
+		}
+		owners = append(owners, sid)
+	}
+
+	installer, err := windows.StringToSid(trustedInstallerSID)
+	if err != nil {
+		return nil, fmt.Errorf("parse TrustedInstaller SID: %w", err)
+	}
+	return append(owners, installer), nil
+}
+
+// trustedWriters are the trustees whose write access does not widen who could
+// decide what runs behind the prompt. The owners, and CREATOR OWNER, which
+// resolves to the object's owner and is therefore already vetted.
+func trustedWriters(owners []*windows.SID) ([]*windows.SID, error) {
+	creatorOwner, err := windows.CreateWellKnownSid(windows.WinCreatorOwnerSid)
+	if err != nil {
+		return nil, fmt.Errorf("build the CREATOR OWNER SID: %w", err)
+	}
+	return append(slices.Clone(owners), creatorOwner), nil
+}
+
+func checkSecurity(path string, writeAccess windows.ACCESS_MASK, owners, writers []*windows.SID) error {
+	sd, err := windows.GetNamedSecurityInfo(path, windows.SE_FILE_OBJECT,
+		windows.OWNER_SECURITY_INFORMATION|windows.DACL_SECURITY_INFORMATION)
+	if err != nil {
+		return fmt.Errorf("read security descriptor of %s: %w", path, err)
+	}
+
+	owner, _, err := sd.Owner()
+	if err != nil {
+		return fmt.Errorf("read owner of %s: %w", path, err)
+	}
+	if !containsSID(owners, owner) {
+		return fmt.Errorf("%s is owned by %s, which is neither this user nor an account that can elevate", path, owner)
+	}
+
+	dacl, _, err := sd.DACL()
+	if err != nil {
+		return fmt.Errorf("read DACL of %s: %w", path, err)
+	}
+	// A NULL DACL grants everyone everything; only an absent security
+	// descriptor would have got us here without one, and neither is trustworthy.
+	if dacl == nil {
+		return fmt.Errorf("%s has no DACL, so it grants write access to everyone", path)
+	}
+
+	return checkDACL(path, dacl, writeAccess, writers)
+}
+
+// checkDACL refuses an ACL that grants write access to a trustee outside
+// writers.
+//
+// An allowlist, because the trustees that must not have it cannot be listed: an
+// ACE naming an ordinary user account hands that account the same power as one
+// naming Everyone, and only the accounts that may hold it are knowable.
+func checkDACL(path string, dacl *windows.ACL, writeAccess windows.ACCESS_MASK, writers []*windows.SID) error {
+	for i := uint32(0); i < uint32(dacl.AceCount); i++ {
+		var ace *windows.ACCESS_ALLOWED_ACE
+		if err := windows.GetAce(dacl, i, &ace); err != nil {
+			return fmt.Errorf("read ACE %d of %s: %w", i, path, err)
+		}
+		// An inherit-only ACE says what children of this object get, not what
+		// this object grants.
+		if ace.Header.AceFlags&windows.INHERIT_ONLY_ACE != 0 {
+			continue
+		}
+		if ace.Mask&writeAccess == 0 {
+			continue
+		}
+		// Only an allow ACE grants anything; a deny ACE narrows what one gave.
+		if !isAllowACE(ace.Header.AceType) {
+			continue
+		}
+
+		trustee, err := aceTrustee(ace)
+		if err != nil {
+			return fmt.Errorf("read the trustee of ACE %d of %s: %w", i, path, err)
+		}
+		if !containsSID(writers, trustee) {
+			return fmt.Errorf("%s grants write access to %s", path, trustee)
+		}
+	}
+	return nil
+}
+
+// isAllowACE reports whether an ACE type grants rights, rather than denying,
+// auditing or labelling them.
+func isAllowACE(aceType uint8) bool {
+	switch aceType {
+	case windows.ACCESS_ALLOWED_ACE_TYPE, accessAllowedCallbackACEType,
+		accessAllowedObjectACEType, accessAllowedCallbackObjectACEType:
+		return true
+	default:
+		return false
+	}
+}
+
+// aceTrustee returns who an allow ACE grants its rights to. An ACE whose trustee
+// cannot be located is an error rather than something to skip past: being unable
+// to read who is being given write access is a refusal.
+func aceTrustee(ace *windows.ACCESS_ALLOWED_ACE) (*windows.SID, error) {
+	switch ace.Header.AceType {
+	case windows.ACCESS_ALLOWED_ACE_TYPE, accessAllowedCallbackACEType:
+		//nolint:gosec // SidStart is the first uint32 of the variable-length SID that follows the ACE header.
+		return (*windows.SID)(unsafe.Pointer(&ace.SidStart)), nil
+	default:
+		return nil, errors.New("an object-type allow ACE does not carry its trustee where we can read it")
+	}
+}
+
+func containsSID(sids []*windows.SID, sid *windows.SID) bool {
+	return slices.ContainsFunc(sids, sid.Equals)
+}
+
+func currentUserSID() (*windows.SID, error) {
+	token := windows.GetCurrentProcessToken()
+	user, err := token.GetTokenUser()
+	if err != nil {
+		return nil, fmt.Errorf("read this process's user: %w", err)
+	}
+	return user.User.Sid, nil
+}
@@ -0,0 +1,126 @@
+package elevate
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sys/windows"
+)
+
+// A file the test user created under their own profile, which is what a per-user
+// install looks like. The whole chain up to the volume root is walked, so this is
+// also what says the walk does not refuse an ordinary Windows installation: the
+// root of every volume grants BUILTIN\Users rights that are not ours to worry
+// about.
+func TestCheckOnlyOwnerWritableAcceptsOwnFile(t *testing.T) {
+	err := checkOnlyOwnerWritable(writeExecutable(t))
+	assert.NoError(t, err, "a file the test user owns, under directories only administrators can write")
+}
+
+// Write access held by an account that cannot answer the UAC prompt means that
+// account decides what runs behind it, whoever the ACE names. The trustees that
+// must not have it cannot be listed, so the check names the ones that may.
+func TestCheckOnlyOwnerWritableRejectsUntrustedWriters(t *testing.T) {
+	tests := []struct {
+		name      string
+		wellKnown windows.WELL_KNOWN_SID_TYPE
+	}{
+		{name: "everyone", wellKnown: windows.WinWorldSid},
+		{name: "authenticated users", wellKnown: windows.WinAuthenticatedUserSid},
+		{name: "builtin users", wellKnown: windows.WinBuiltinUsersSid},
+		// A service account, which no denylist of the obvious groups would name
+		// and which cannot elevate any more than Everyone can.
+		{name: "local service", wellKnown: windows.WinLocalServiceSid},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			path := writeExecutable(t)
+			grantWrite(t, path, tt.wellKnown)
+
+			assert.Error(t, checkOnlyOwnerWritable(path),
+				"write access for %s must be refused", tt.name)
+		})
+	}
+}
+
+// The masks are the policy: on a file any write reaches its contents, while on a
+// directory only deleting or taking over an entry reaches something already
+// there. Adding an entry does not, which is why the walk survives a volume root.
+func TestWriteAccessMasks(t *testing.T) {
+	assert.NotZero(t, fileWriteAccess&windows.FILE_WRITE_DATA, "writing a file's data reaches its contents")
+	assert.NotZero(t, fileWriteAccess&windows.FILE_APPEND_DATA, "appending to a file reaches its contents")
+
+	assert.Zero(t, dirWriteAccess&windows.FILE_WRITE_DATA, "adding a file to a directory replaces nothing")
+	assert.Zero(t, dirWriteAccess&windows.FILE_APPEND_DATA, "adding a subdirectory replaces nothing")
+	assert.NotZero(t, dirWriteAccess&fileDeleteChild, "deleting an entry replaces it")
+	assert.NotZero(t, dirWriteAccess&windows.DELETE, "deleting the directory takes its entries with it")
+}
+
+func TestIsAllowACE(t *testing.T) {
+	tests := []struct {
+		name    string
+		aceType uint8
+		want    bool
+	}{
+		{name: "allowed", aceType: windows.ACCESS_ALLOWED_ACE_TYPE, want: true},
+		{name: "allowed callback", aceType: accessAllowedCallbackACEType, want: true},
+		{name: "allowed object", aceType: accessAllowedObjectACEType, want: true},
+		{name: "allowed callback object", aceType: accessAllowedCallbackObjectACEType, want: true},
+		{name: "denied", aceType: windows.ACCESS_DENIED_ACE_TYPE},
+		// SYSTEM_AUDIT_ACE_TYPE, which x/sys does not define: an ACE that records
+		// access rather than granting it.
+		{name: "audit", aceType: 0x2},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, isAllowACE(tt.aceType), "ACE type %#x", tt.aceType)
+		})
+	}
+}
+
+// writeExecutable creates a plain file under the test's own directory, the shape
+// trustedSelf checks.
+func writeExecutable(t *testing.T) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "netbird-ui.exe")
+	require.NoError(t, os.WriteFile(path, []byte("MZ"), 0o755), "write the executable")
+	return path
+}
+
+// grantWrite replaces the file's DACL with one that grants a well-known trustee
+// everything, keeping the test user's own access so the file stays deletable.
+func grantWrite(t *testing.T, path string, wellKnown windows.WELL_KNOWN_SID_TYPE) {
+	t.Helper()
+
+	trustee, err := windows.CreateWellKnownSid(wellKnown)
+	require.NoError(t, err, "build the trustee SID")
+	self, err := currentUserSID()
+	require.NoError(t, err, "read the test user's SID")
+
+	acl, err := windows.ACLFromEntries([]windows.EXPLICIT_ACCESS{
+		fullControl(self, windows.TRUSTEE_IS_USER),
+		fullControl(trustee, windows.TRUSTEE_IS_WELL_KNOWN_GROUP),
+	}, nil)
+	require.NoError(t, err, "build the ACL")
+
+	require.NoError(t, windows.SetNamedSecurityInfo(path, windows.SE_FILE_OBJECT,
+		windows.DACL_SECURITY_INFORMATION|windows.PROTECTED_DACL_SECURITY_INFORMATION,
+		nil, nil, acl, nil), "set the DACL")
+}
+
+func fullControl(sid *windows.SID, trusteeType uint32) windows.EXPLICIT_ACCESS {
+	return windows.EXPLICIT_ACCESS{
+		AccessPermissions: windows.GENERIC_ALL,
+		AccessMode:        windows.GRANT_ACCESS,
+		Trustee: windows.TRUSTEE{
+			TrusteeForm:  windows.TRUSTEE_IS_SID,
+			TrusteeType:  windows.TRUSTEE_TYPE(trusteeType),
+			TrusteeValue: windows.TrusteeValueFromSID(sid),
+		},
+	}
+}
@@ -59,7 +59,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/syncstore"
 	"github.com/netbirdio/netbird/client/internal/updater"
 	"github.com/netbirdio/netbird/client/jobexec"
-	"github.com/netbirdio/netbird/client/netstate"
+	"github.com/netbirdio/netbird/client/netevents"
 	cProto "github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/system"
 	nbdns "github.com/netbirdio/netbird/dns"
@@ -182,9 +182,9 @@ type EngineServices struct {
 	UpdateManager  *updater.Manager
 	ClientMetrics  *metrics.ClientMetrics
 	MetricsCtx     context.Context
-	// NetState gates the reconnection loops on OS-reported network
+	// NetMgr gates the reconnection loops on OS-reported network
 	// availability; nil disables gating.
-	NetState *netstate.State
+	NetMgr *netevents.Manager
 }

 // Engine is a mechanism responsible for reacting on Signal and Management stream events and managing connections to the remote peers.
@@ -208,9 +208,9 @@ type Engine struct {
 	config    *EngineConfig
 	mobileDep MobileDependency

-	// netState gates the peer reconnection guards on OS-reported network
+	// netMgr gates the peer reconnection guards on OS-reported network
 	// availability; nil disables gating.
-	netState *netstate.State
+	netMgr *netevents.Manager

 	// STUNs is a list of STUN servers used by ICE
 	STUNs []*stun.URI
@@ -345,7 +345,7 @@ func NewEngine(
 		syncMsgMux:         &sync.Mutex{},
 		config:             config,
 		mobileDep:          mobileDep,
-		netState:           services.NetState,
+		netMgr:             services.NetMgr,
 		STUNs:              []*stun.URI{},
 		TURNs:              []*stun.URI{},
 		networkSerial:      0,
@@ -833,7 +833,7 @@ func (e *Engine) blockLanAccess() {

 // modifyPeers updates peers that have been modified (e.g. IP address has been changed).
 // It closes the existing connection, removes it from the peerConns map, and creates a new one.
-func (e *Engine) modifyPeers(peersUpdate []*mgmProto.RemotePeerConfig) error {
+func (e *Engine) modifyPeers(peersUpdate []*mgmProto.RemotePeerConfig, forwardingRules []firewallManager.ForwardRule) error {

 	// first, check if peers have been modified
 	var modified []*mgmProto.RemotePeerConfig
@@ -872,7 +872,7 @@ func (e *Engine) modifyPeers(peersUpdate []*mgmProto.RemotePeerConfig) error {
 	}
 	// third, add the peer connections again
 	for _, p := range modified {
-		err := e.addNewPeer(p)
+		err := e.addNewPeer(p, forwardingRules)
 		if err != nil {
 			return err
 		}
@@ -1495,8 +1495,12 @@ func (e *Engine) updateNetworkMap(networkMap *mgmProto.NetworkMap) error {
 		return nil
 	}

-	if err := e.connMgr.UpdatedRemoteFeatureFlag(e.ctx, networkMap.GetPeerConfig().GetLazyConnectionEnabled()); err != nil {
-		log.Errorf("failed to update lazy connection feature flag: %v", err)
+	// Only update the flag when the sync carries a peer config; a nil peer config
+	// (e.g. a partial update) must not reset the cached flag to false.
+	if peerConfig := networkMap.GetPeerConfig(); peerConfig != nil {
+		if err := e.connMgr.UpdatedRemoteFeatureFlag(e.ctx, peerConfig.GetLazyConnectionEnabled()); err != nil {
+			log.Errorf("failed to update lazy connection feature flag: %v", err)
+		}
 	}

 	if e.firewall != nil {
@@ -1574,15 +1578,14 @@ func (e *Engine) updateNetworkMap(networkMap *mgmProto.NetworkMap) error {
 	e.updateOfflinePeers(networkMap.GetOfflinePeers())
 	done()

-	remotePeers, err := e.reconcilePeers(networkMap)
+	remotePeers, err := e.reconcilePeers(networkMap, forwardingRules)
 	if err != nil {
 		return err
 	}

 	// must set the exclude list after the peers are added. Without it the manager can not figure out the peers parameters from the store
 	done = e.phase("lazy_exclude")
-	excludedLazyPeers := e.toExcludedLazyPeers(forwardingRules, remotePeers)
-	e.connMgr.SetExcludeList(e.ctx, excludedLazyPeers)
+	e.connMgr.SetExcludeList(e.ctx, e.toExcludedLazyPeers(forwardingRules, remotePeers))
 	done()

 	e.networkSerial = serial
@@ -1592,8 +1595,10 @@ func (e *Engine) updateNetworkMap(networkMap *mgmProto.NetworkMap) error {

 // reconcilePeers applies the remote peer list from the network map (removing,
 // modifying and adding peers, then updating SSH config) and returns the remote
-// peers with our own peer filtered out, for use by later sync steps.
-func (e *Engine) reconcilePeers(networkMap *mgmProto.NetworkMap) ([]*mgmProto.RemotePeerConfig, error) {
+// peers with our own peer filtered out, for use by later sync steps. The
+// forwarding rules are used to decide whether a newly added peer needs an
+// always-active connection.
+func (e *Engine) reconcilePeers(networkMap *mgmProto.NetworkMap, forwardingRules []firewallManager.ForwardRule) ([]*mgmProto.RemotePeerConfig, error) {
 	// Filter out own peer from the remote peers list
 	localPubKey := e.config.WgPrivateKey.PublicKey().String()
 	remotePeers := make([]*mgmProto.RemotePeerConfig, 0, len(networkMap.GetRemotePeers()))
@@ -1621,14 +1626,14 @@ func (e *Engine) reconcilePeers(networkMap *mgmProto.NetworkMap) ([]*mgmProto.Re
 	}

 	done = e.phase("modified_peers")
-	err = e.modifyPeers(remotePeers)
+	err = e.modifyPeers(remotePeers, forwardingRules)
 	done()
 	if err != nil {
 		return nil, err
 	}

 	done = e.phase("added_peers")
-	err = e.addNewPeers(remotePeers)
+	err = e.addNewPeers(remotePeers, forwardingRules)
 	done()
 	if err != nil {
 		return nil, err
@@ -1824,9 +1829,9 @@ func addrToString(addr netip.Addr) string {
 }

 // addNewPeers adds peers that were not know before but arrived from the Management service with the update
-func (e *Engine) addNewPeers(peersUpdate []*mgmProto.RemotePeerConfig) error {
+func (e *Engine) addNewPeers(peersUpdate []*mgmProto.RemotePeerConfig, forwardingRules []firewallManager.ForwardRule) error {
 	for _, p := range peersUpdate {
-		err := e.addNewPeer(p)
+		err := e.addNewPeer(p, forwardingRules)
 		if err != nil {
 			return err
 		}
@@ -1834,8 +1839,9 @@ func (e *Engine) addNewPeers(peersUpdate []*mgmProto.RemotePeerConfig) error {
 	return nil
 }

-// addNewPeer add peer if connection doesn't exist
-func (e *Engine) addNewPeer(peerConfig *mgmProto.RemotePeerConfig) error {
+// addNewPeer add peer if connection doesn't exist. A peer that is not lazy by
+// policy (or is a forwarder) gets an always-active connection instead.
+func (e *Engine) addNewPeer(peerConfig *mgmProto.RemotePeerConfig, forwardingRules []firewallManager.ForwardRule) error {
 	peerKey := peerConfig.GetWgPubKey()
 	peerIPs := make([]netip.Prefix, 0, len(peerConfig.GetAllowedIps()))
 	if _, ok := e.peerStore.PeerConn(peerKey); ok {
@@ -1869,7 +1875,7 @@ func (e *Engine) addNewPeer(peerConfig *mgmProto.RemotePeerConfig) error {
 		log.Warnf("error adding peer %s to status recorder, got error: %v", peerKey, err)
 	}

-	if exists := e.connMgr.AddPeerConn(e.ctx, peerKey, conn); exists {
+	if exists := e.connMgr.AddPeerConn(e.ctx, peerKey, conn, e.isPermanentPeer(peerConfig, forwardingRules)); exists {
 		conn.Close(false)
 		return fmt.Errorf("peer already exists: %s", peerKey)
 	}
@@ -1902,8 +1908,8 @@ func (e *Engine) createPeerConn(pubKey string, allowedIPs []netip.Prefix, agentV
 			Addr:           e.getRosenpassAddr(),
 			PermissiveMode: e.config.RosenpassPermissive,
 		},
-		ICEConfig:    e.createICEConfig(),
-		NetworkState: e.netState,
+		ICEConfig: e.createICEConfig(),
+		NetMgr:    e.netMgr,
 	}

 	serviceDependencies := peer.ServiceDependencies{
@@ -2661,34 +2667,44 @@ func (e *Engine) updateForwardRules(rules []*mgmProto.ForwardingRule) ([]firewal
 	return forwardingRules, nberrors.FormatErrorOrNil(merr)
 }

+// toExcludedLazyPeers returns the peers that must have an always-active
+// connection, so the caller can reconcile the lazy manager's exclude list.
 func (e *Engine) toExcludedLazyPeers(rules []firewallManager.ForwardRule, peers []*mgmProto.RemotePeerConfig) map[string]bool {
 	excludedPeers := make(map[string]bool)
-
-	// Ingress forward targets: inbound forwarded traffic is initiated remotely and
-	// cannot wake a lazy connection, so the peer routing the target must stay
-	// permanently connected. AllowedIPs are already parsed on the peer conn, so
-	// reuse those typed prefixes instead of re-parsing the network map strings.
-	for _, r := range rules {
-		for _, p := range peers {
-			if e.peerRoutesAddr(p, r.TranslatedAddress) {
-				log.Infof("exclude forwarder peer from lazy connection: %s", p.GetWgPubKey())
-				excludedPeers[p.GetWgPubKey()] = true
-			}
+	for _, p := range peers {
+		if e.isPermanentPeer(p, rules) {
+			excludedPeers[p.GetWgPubKey()] = true
 		}
 	}
-
 	return excludedPeers
 }

-// peerRoutesAddr reports whether the peer is a router for addr, matched against
-// the peer's already-parsed AllowedIPs from the store (the same typed value the
-// lazy manager consumes) rather than re-parsing the network map strings.
-func (e *Engine) peerRoutesAddr(p *mgmProto.RemotePeerConfig, addr netip.Addr) bool {
-	prefixes, ok := e.peerStore.AllowedIPs(p.GetWgPubKey())
-	if !ok {
-		return false
+// isPermanentPeer reports whether a peer needs an always-active connection: it
+// is not lazy by policy (the per-peer lazy hint or account flag, subject to the
+// local override), or it is an ingress forward target. Inbound forwarded traffic
+// is initiated remotely and cannot wake a lazy connection, so the peer routing
+// the target must stay permanently connected.
+func (e *Engine) isPermanentPeer(p *mgmProto.RemotePeerConfig, rules []firewallManager.ForwardRule) bool {
+	if !e.connMgr.PeerLazyDefault(p.GetLazyState()) {
+		return true
 	}
-	return prefixesContain(prefixes, addr)
+
+	// Match against the incoming config's AllowedIPs rather than the peer store:
+	// isPermanentPeer runs in addNewPeer before the peer is in the store, so a
+	// store lookup would miss a forward target and register it as lazy.
+	prefixes := make([]netip.Prefix, 0, len(p.GetAllowedIps()))
+	for _, ipStr := range p.GetAllowedIps() {
+		if prefix, err := netip.ParsePrefix(ipStr); err == nil {
+			prefixes = append(prefixes, prefix)
+		}
+	}
+	for _, r := range rules {
+		if prefixesContain(prefixes, r.TranslatedAddress) {
+			log.Infof("exclude forwarder peer from lazy connection: %s", p.GetWgPubKey())
+			return true
+		}
+	}
+	return false
 }

 // prefixesContain reports whether addr falls within any of the prefixes.
@@ -49,7 +49,8 @@ func TestToExcludedLazyPeers_ForwardTarget(t *testing.T) {
 	store.AddPeerConn(targetPeerKey, newTestConn(t, targetPeerKey, "100.110.8.145/32"))
 	store.AddPeerConn(otherPeerKey, newTestConn(t, otherPeerKey, "100.110.9.10/32"))

-	e := &Engine{peerStore: store}
+	// Lazy on for normal peers, so the only exclusion under test is the forward target.
+	e := &Engine{peerStore: store, connMgr: &ConnMgr{force: lazyForceOn}}

 	peers := []*mgmProto.RemotePeerConfig{
 		{WgPubKey: targetPeerKey, AllowedIps: []string{"100.110.8.145/32"}},
@@ -67,7 +68,8 @@ func TestToExcludedLazyPeers_ForwardTarget(t *testing.T) {
 }

 func TestToExcludedLazyPeers_NoRules(t *testing.T) {
-	e := &Engine{peerStore: peerstore.NewConnStore()}
+	// Lazy on for normal peers and no forward rules, so nothing is excluded.
+	e := &Engine{peerStore: peerstore.NewConnStore(), connMgr: &ConnMgr{force: lazyForceOn}}

 	peers := []*mgmProto.RemotePeerConfig{
 		{WgPubKey: "peer-a", AllowedIps: []string{"100.110.8.145/32"}},
@@ -279,7 +279,8 @@ func TestEngine_UpdateNetworkMap(t *testing.T) {
 	}, MobileDependency{})

 	wgIface := &MockWGIface{
-		NameFunc: func() string { return "utun102" },
+		NameFunc:            func() string { return "utun102" },
+		IsUserspaceBindFunc: func() bool { return true },
 		RemovePeerFunc: func(peerKey string) error {
 			return nil
 		},
@@ -0,0 +1,36 @@
+//go:build cgo && !osusergo && !windows
+
+package getent
+
+import "os/user"
+
+// Built with cgo, os/user resolves through libc (getpwnam_r and friends),
+// which goes through the host's NSS stack natively. Whatever it fails to
+// find, the getent command would not find either, so there is nothing to
+// fall back to.
+
+// LookupUser looks up a user by name.
+func LookupUser(username string) (*user.User, error) {
+	return user.Lookup(username)
+}
+
+// LookupUserID looks up a user by UID.
+func LookupUserID(uid string) (*user.User, error) {
+	return user.LookupId(uid)
+}
+
+// CurrentUser returns the user this process runs as.
+func CurrentUser() (*user.User, error) {
+	return user.Current()
+}
+
+// LookupGroupID looks up a group by GID.
+func LookupGroupID(gid string) (*user.Group, error) {
+	return user.LookupGroupId(gid)
+}
+
+// GroupIDs returns the IDs of the groups the user is a member of; libc's
+// getgrouplist handles NSS groups natively.
+func GroupIDs(u *user.User) ([]string, error) {
+	return u.GroupIds()
+}
@@ -0,0 +1,6 @@
+// Package getent resolves users and groups through the host's NSS stack.
+// Built without cgo, os/user reads /etc/passwd and /etc/group alone and misses
+// anything LDAP, SSSD or winbind provide; the getent and id commands resolve
+// through NSS whatever the build. The lookups here try the standard library
+// first, which needs no subprocess, and fall back to those commands.
+package getent
@@ -0,0 +1,155 @@
+package getent
+
+import (
+	"os/user"
+	"runtime"
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestLookupUser_CurrentUser(t *testing.T) {
+	// The current user should always be resolvable on any platform
+	current, err := user.Current()
+	require.NoError(t, err)
+
+	u, err := LookupUser(current.Username)
+	require.NoError(t, err)
+	assert.Equal(t, current.Username, u.Username)
+	assert.Equal(t, current.Uid, u.Uid)
+	assert.Equal(t, current.Gid, u.Gid)
+}
+
+func TestLookupUser_NonexistentUser(t *testing.T) {
+	_, err := LookupUser("nonexistent_user_xyzzy_12345")
+	require.Error(t, err, "should fail for nonexistent user")
+}
+
+func TestLookupUserID_CurrentUser(t *testing.T) {
+	current, err := user.Current()
+	require.NoError(t, err)
+
+	u, err := LookupUserID(current.Uid)
+	require.NoError(t, err)
+	assert.Equal(t, current.Username, u.Username)
+	assert.Equal(t, current.Uid, u.Uid)
+}
+
+func TestCurrentUser(t *testing.T) {
+	stdUser, err := user.Current()
+	require.NoError(t, err)
+
+	u, err := CurrentUser()
+	require.NoError(t, err)
+	assert.Equal(t, stdUser.Uid, u.Uid)
+	assert.Equal(t, stdUser.Username, u.Username)
+}
+
+func TestGroupIDs_CurrentUser(t *testing.T) {
+	current, err := user.Current()
+	require.NoError(t, err)
+
+	groups, err := GroupIDs(current)
+	require.NoError(t, err)
+	require.NotEmpty(t, groups, "current user should have at least one group")
+
+	if runtime.GOOS != "windows" {
+		for _, gid := range groups {
+			_, err := strconv.ParseUint(gid, 10, 32)
+			assert.NoError(t, err, "group ID %q should be a valid uint32", gid)
+		}
+	}
+}
+
+func TestUserShell_CurrentUser(t *testing.T) {
+	current, err := user.Current()
+	require.NoError(t, err)
+
+	// getent may not be available on all systems (e.g., macOS without
+	// Homebrew getent), and Windows has no login shells at all.
+	shell, err := UserShell(current.Uid)
+	if err != nil {
+		t.Logf("UserShell failed, getent may not be available: %v", err)
+		return
+	}
+	if shell == "" {
+		t.Log("UserShell returned empty, the user has no shell set")
+		return
+	}
+	assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
+}
+
+func TestLookupUser_RootUser(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("no root user on Windows")
+	}
+
+	u, err := LookupUser("root")
+	if err != nil {
+		t.Skip("root user not available on this system")
+	}
+	assert.Equal(t, "0", u.Uid, "root should have UID 0")
+}
+
+// TestIntegration_FullLookupChain exercises the complete user lookup chain
+// against the real system, testing that all wrappers (LookupUser,
+// CurrentUser, GroupIDs, UserShell) produce consistent and correct results
+// when composed together.
+func TestIntegration_FullLookupChain(t *testing.T) {
+	// Step 1: CurrentUser must resolve the running user.
+	current, err := CurrentUser()
+	require.NoError(t, err, "CurrentUser must resolve the running user")
+	require.NotEmpty(t, current.Uid)
+	require.NotEmpty(t, current.Username)
+
+	// Step 2: LookupUser by the same username must return matching identity.
+	byName, err := LookupUser(current.Username)
+	require.NoError(t, err)
+	assert.Equal(t, current.Uid, byName.Uid, "lookup by name should return same UID")
+	assert.Equal(t, current.Gid, byName.Gid, "lookup by name should return same GID")
+	assert.Equal(t, current.HomeDir, byName.HomeDir, "lookup by name should return same home")
+
+	// Step 3: GroupIDs must return at least the primary GID.
+	groups, err := GroupIDs(current)
+	require.NoError(t, err)
+	require.NotEmpty(t, groups, "user must have at least one group")
+
+	foundPrimary := false
+	for _, gid := range groups {
+		if runtime.GOOS != "windows" {
+			_, err := strconv.ParseUint(gid, 10, 32)
+			require.NoError(t, err, "group ID %q must be a valid uint32", gid)
+		}
+		if gid == current.Gid {
+			foundPrimary = true
+		}
+	}
+	assert.True(t, foundPrimary, "primary GID %s should appear in supplementary groups", current.Gid)
+}
+
+// TestIntegration_LookupAndGroupsConsistency verifies that a user resolved via
+// LookupUser can have their groups resolved via GroupIDs, testing the handoff
+// between the two functions as used by the SSH server.
+func TestIntegration_LookupAndGroupsConsistency(t *testing.T) {
+	current, err := user.Current()
+	require.NoError(t, err)
+
+	// Simulate the SSH server flow: lookup user, then get their groups.
+	resolved, err := LookupUser(current.Username)
+	require.NoError(t, err)
+
+	groups, err := GroupIDs(resolved)
+	require.NoError(t, err)
+	require.NotEmpty(t, groups, "resolved user must have groups")
+
+	// On Unix, all returned GIDs must be valid numeric values.
+	// On Windows, group IDs are SIDs (e.g., "S-1-5-32-544").
+	if runtime.GOOS != "windows" {
+		for _, gid := range groups {
+			_, err := strconv.ParseUint(gid, 10, 32)
+			assert.NoError(t, err, "group ID %q should be numeric", gid)
+		}
+	}
+}
@@ -0,0 +1,110 @@
+//go:build (!cgo || osusergo) && !windows
+
+package getent
+
+import (
+	"os"
+	"os/user"
+	"strconv"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// Without cgo, os/user only reads /etc/passwd and /etc/group and misses
+// NSS-provided users and groups; the getent and id commands go through the
+// host's NSS stack.
+
+// LookupUser looks up a user by name, falling back to getent if os/user fails.
+func LookupUser(username string) (*user.User, error) {
+	u, err := user.Lookup(username)
+	if err == nil {
+		return u, nil
+	}
+
+	stdErr := err
+	log.Debugf("os/user.Lookup(%q) failed, trying getent: %v", username, err)
+
+	u, _, getentErr := passwdLookup(username)
+	if getentErr != nil {
+		log.Debugf("getent fallback for %q also failed: %v", username, getentErr)
+		return nil, stdErr
+	}
+	return u, nil
+}
+
+// LookupUserID looks up a user by UID, falling back to getent if os/user fails.
+func LookupUserID(uid string) (*user.User, error) {
+	u, err := user.LookupId(uid)
+	if err == nil {
+		return u, nil
+	}
+
+	stdErr := err
+	log.Debugf("os/user.LookupId(%q) failed, trying getent: %v", uid, err)
+
+	u, _, getentErr := passwdLookup(uid)
+	if getentErr != nil {
+		log.Debugf("getent fallback for uid %s also failed: %v", uid, getentErr)
+		return nil, stdErr
+	}
+	return u, nil
+}
+
+// CurrentUser returns the user this process runs as, falling back to getent
+// if os/user fails.
+func CurrentUser() (*user.User, error) {
+	u, err := user.Current()
+	if err == nil {
+		return u, nil
+	}
+
+	stdErr := err
+	uid := strconv.Itoa(os.Getuid())
+	log.Debugf("os/user.Current() failed, trying getent with UID %s: %v", uid, err)
+
+	u, _, getentErr := passwdLookup(uid)
+	if getentErr != nil {
+		return nil, stdErr
+	}
+	return u, nil
+}
+
+// LookupGroupID looks up a group by GID, falling back to getent if os/user
+// fails.
+func LookupGroupID(gid string) (*user.Group, error) {
+	g, err := user.LookupGroupId(gid)
+	if err == nil {
+		return g, nil
+	}
+
+	stdErr := err
+	log.Debugf("os/user.LookupGroupId(%q) failed, trying getent: %v", gid, err)
+
+	g, _, getentErr := groupLookup(gid)
+	if getentErr != nil {
+		log.Debugf("getent fallback for gid %s also failed: %v", gid, getentErr)
+		return nil, stdErr
+	}
+	return g, nil
+}
+
+// GroupIDs returns the IDs of the groups the user is a member of.
+// NOTE: unlike the lookups above, which try the standard library first, this
+// intentionally tries `id -G` first because without cgo, user.GroupIds only
+// reads /etc/group and silently returns incomplete results for NSS users
+// (no error, just missing groups). The id command goes through NSS and
+// returns the full set.
+func GroupIDs(u *user.User) ([]string, error) {
+	ids, err := idGroups(u.Username)
+	if err == nil {
+		return ids, nil
+	}
+
+	log.Debugf("id -G %q failed, falling back to user.GroupIds(): %v", u.Username, err)
+
+	ids, stdErr := u.GroupIds()
+	if stdErr != nil {
+		return nil, stdErr
+	}
+	return ids, nil
+}
@@ -0,0 +1,224 @@
+//go:build !windows
+
+package getent
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+	"os/user"
+	"runtime"
+	"strings"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+)
+
+const commandTimeout = 5 * time.Second
+
+// groupFile lists which accounts are in which group, for hosts where the
+// getent command is not available (macOS ships without it).
+const groupFile = "/etc/group"
+
+// UserShell returns the login shell getent reports for the user with this UID.
+// It reaches shells that /etc/passwd does not list, because getent resolves
+// through the host's NSS stack.
+func UserShell(uid string) (string, error) {
+	_, shell, err := passwdLookup(uid)
+	if err != nil {
+		return "", err
+	}
+	return shell, nil
+}
+
+// GroupMembers returns the names of the group's members: from getent, which
+// resolves through NSS, or from /etc/group where getent is not available. A
+// group neither source describes is an error; an empty member list is not,
+// since accounts with the group as their primary one are not listed in it.
+func GroupMembers(name string) ([]string, error) {
+	_, members, err := groupLookup(name)
+	if err == nil {
+		return members, nil
+	}
+	log.Debugf("getent cannot list group %q, reading %s: %v", name, groupFile, err)
+	return groupMembersFromFile(groupFile, name)
+}
+
+// passwdLookup executes `getent passwd <query>`, where query is a username or
+// UID, and returns the user and login shell.
+func passwdLookup(query string) (*user.User, string, error) {
+	out, err := run("passwd", query)
+	if err != nil {
+		return nil, "", err
+	}
+	return parsePasswd(string(out))
+}
+
+// groupLookup executes `getent group <query>`, where query is a group name or
+// GID, and returns the group and its member names.
+func groupLookup(query string) (*user.Group, []string, error) {
+	out, err := run("group", query)
+	if err != nil {
+		return nil, nil, err
+	}
+	return parseGroup(string(out))
+}
+
+// run executes `getent <database> <key>` with a timeout.
+func run(database, key string) ([]byte, error) {
+	if !validateInput(key) {
+		return nil, fmt.Errorf("invalid getent input: %q", key)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), commandTimeout)
+	defer cancel()
+
+	out, err := exec.CommandContext(ctx, "getent", database, key).Output()
+	if err != nil {
+		return nil, fmt.Errorf("getent %s %s: %w", database, key, err)
+	}
+	return out, nil
+}
+
+// parsePasswd parses getent passwd output: "name:x:uid:gid:gecos:home:shell"
+func parsePasswd(output string) (*user.User, string, error) {
+	fields := strings.SplitN(strings.TrimSpace(output), ":", 8)
+	if len(fields) < 6 {
+		return nil, "", fmt.Errorf("unexpected getent output (need 6+ fields): %q", output)
+	}
+
+	if fields[0] == "" || fields[2] == "" || fields[3] == "" {
+		return nil, "", fmt.Errorf("missing required fields in getent output: %q", output)
+	}
+
+	var shell string
+	if len(fields) >= 7 {
+		shell = fields[6]
+	}
+
+	return &user.User{
+		Username: fields[0],
+		Uid:      fields[2],
+		Gid:      fields[3],
+		Name:     fields[4],
+		HomeDir:  fields[5],
+	}, shell, nil
+}
+
+// parseGroup parses getent group output: "name:x:gid:member,member"
+func parseGroup(output string) (*user.Group, []string, error) {
+	fields := strings.SplitN(strings.TrimSpace(output), ":", 4)
+	if len(fields) < 3 {
+		return nil, nil, fmt.Errorf("unexpected getent output (need 3+ fields): %q", output)
+	}
+
+	if fields[0] == "" || fields[2] == "" {
+		return nil, nil, fmt.Errorf("missing required fields in getent output: %q", output)
+	}
+
+	var members []string
+	if len(fields) >= 4 {
+		members = splitMembers(fields[3])
+	}
+	return &user.Group{Name: fields[0], Gid: fields[2]}, members, nil
+}
+
+func splitMembers(list string) []string {
+	var members []string
+	for member := range strings.SplitSeq(list, ",") {
+		if member != "" {
+			members = append(members, member)
+		}
+	}
+	return members
+}
+
+// groupMembersFromFile finds the group's member list in a file of /etc/group's
+// format. A group the file does not describe, because it comes from LDAP or
+// another NSS source, is an error rather than an empty list.
+func groupMembersFromFile(path, name string) ([]string, error) {
+	file, err := os.Open(path)
+	if err != nil {
+		return nil, fmt.Errorf("open %s: %w", path, err)
+	}
+	defer func() {
+		if err := file.Close(); err != nil {
+			log.Debugf("close %s: %v", path, err)
+		}
+	}()
+
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		// name:password:gid:member,member
+		fields := strings.Split(scanner.Text(), ":")
+		if len(fields) < 4 || fields[0] != name {
+			continue
+		}
+		return splitMembers(fields[3]), nil
+	}
+	if err := scanner.Err(); err != nil {
+		return nil, fmt.Errorf("read %s: %w", path, err)
+	}
+	return nil, fmt.Errorf("%s does not describe group %q", path, name)
+}
+
+// validateInput checks that the input is safe to pass to getent or id.
+// Allows POSIX usernames, numeric IDs, and common NSS extensions
+// (@ for Kerberos, $ for Samba, + for NIS compat). A leading hyphen is
+// rejected so the input can never be parsed as a command-line flag.
+func validateInput(input string) bool {
+	maxLen := 32
+	if runtime.GOOS == "linux" {
+		maxLen = 256
+	}
+
+	if len(input) == 0 || len(input) > maxLen {
+		return false
+	}
+
+	if input[0] == '-' {
+		return false
+	}
+
+	for _, r := range input {
+		if isAllowedChar(r) {
+			continue
+		}
+		return false
+	}
+	return true
+}
+
+func isAllowedChar(r rune) bool {
+	if r >= 'a' && r <= 'z' || r >= 'A' && r <= 'Z' || r >= '0' && r <= '9' {
+		return true
+	}
+	switch r {
+	case '.', '_', '-', '@', '+', '$':
+		return true
+	}
+	return false
+}
+
+// idGroups runs `id -G <username>` and returns the space-separated group IDs.
+func idGroups(username string) ([]string, error) {
+	if !validateInput(username) {
+		return nil, fmt.Errorf("invalid username for id command: %q", username)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), commandTimeout)
+	defer cancel()
+
+	out, err := exec.CommandContext(ctx, "id", "-G", username).Output()
+	if err != nil {
+		return nil, fmt.Errorf("id -G %s: %w", username, err)
+	}
+
+	trimmed := strings.TrimSpace(string(out))
+	if trimmed == "" {
+		return nil, fmt.Errorf("id -G %s: empty output", username)
+	}
+	return strings.Fields(trimmed), nil
+}
@@ -0,0 +1,471 @@
+//go:build !windows
+
+package getent
+
+import (
+	"os"
+	"os/exec"
+	"os/user"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParsePasswd(t *testing.T) {
+	tests := []struct {
+		name        string
+		input       string
+		wantUser    *user.User
+		wantShell   string
+		wantErr     bool
+		errContains string
+	}{
+		{
+			name:  "standard entry",
+			input: "alice:x:1001:1001:Alice Smith:/home/alice:/bin/bash\n",
+			wantUser: &user.User{
+				Username: "alice",
+				Uid:      "1001",
+				Gid:      "1001",
+				Name:     "Alice Smith",
+				HomeDir:  "/home/alice",
+			},
+			wantShell: "/bin/bash",
+		},
+		{
+			name:  "root entry",
+			input: "root:x:0:0:root:/root:/bin/bash",
+			wantUser: &user.User{
+				Username: "root",
+				Uid:      "0",
+				Gid:      "0",
+				Name:     "root",
+				HomeDir:  "/root",
+			},
+			wantShell: "/bin/bash",
+		},
+		{
+			name:  "empty gecos field",
+			input: "svc:x:999:999::/var/lib/svc:/usr/sbin/nologin",
+			wantUser: &user.User{
+				Username: "svc",
+				Uid:      "999",
+				Gid:      "999",
+				Name:     "",
+				HomeDir:  "/var/lib/svc",
+			},
+			wantShell: "/usr/sbin/nologin",
+		},
+		{
+			name:  "gecos with commas",
+			input: "john:x:1002:1002:John Doe,Room 101,555-1234,555-4321:/home/john:/bin/zsh",
+			wantUser: &user.User{
+				Username: "john",
+				Uid:      "1002",
+				Gid:      "1002",
+				Name:     "John Doe,Room 101,555-1234,555-4321",
+				HomeDir:  "/home/john",
+			},
+			wantShell: "/bin/zsh",
+		},
+		{
+			name:  "remote user with large UID",
+			input: "remoteuser:*:50001:50001:Remote User:/home/remoteuser:/bin/bash\n",
+			wantUser: &user.User{
+				Username: "remoteuser",
+				Uid:      "50001",
+				Gid:      "50001",
+				Name:     "Remote User",
+				HomeDir:  "/home/remoteuser",
+			},
+			wantShell: "/bin/bash",
+		},
+		{
+			name:  "no shell field (only 6 fields)",
+			input: "minimal:x:1000:1000::/home/minimal",
+			wantUser: &user.User{
+				Username: "minimal",
+				Uid:      "1000",
+				Gid:      "1000",
+				Name:     "",
+				HomeDir:  "/home/minimal",
+			},
+			wantShell: "",
+		},
+		{
+			name:        "too few fields",
+			input:       "bad:x:1000",
+			wantErr:     true,
+			errContains: "need 6+ fields",
+		},
+		{
+			name:        "empty username",
+			input:       ":x:1000:1000::/home/test:/bin/bash",
+			wantErr:     true,
+			errContains: "missing required fields",
+		},
+		{
+			name:        "empty UID",
+			input:       "test:x::1000::/home/test:/bin/bash",
+			wantErr:     true,
+			errContains: "missing required fields",
+		},
+		{
+			name:        "empty GID",
+			input:       "test:x:1000:::/home/test:/bin/bash",
+			wantErr:     true,
+			errContains: "missing required fields",
+		},
+		{
+			name:        "empty input",
+			input:       "",
+			wantErr:     true,
+			errContains: "need 6+ fields",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			u, shell, err := parsePasswd(tt.input)
+			if tt.wantErr {
+				require.Error(t, err)
+				if tt.errContains != "" {
+					assert.Contains(t, err.Error(), tt.errContains)
+				}
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantUser.Username, u.Username, "username")
+			assert.Equal(t, tt.wantUser.Uid, u.Uid, "UID")
+			assert.Equal(t, tt.wantUser.Gid, u.Gid, "GID")
+			assert.Equal(t, tt.wantUser.Name, u.Name, "name/gecos")
+			assert.Equal(t, tt.wantUser.HomeDir, u.HomeDir, "home directory")
+			assert.Equal(t, tt.wantShell, shell, "shell")
+		})
+	}
+}
+
+func TestParseGroup(t *testing.T) {
+	tests := []struct {
+		name        string
+		input       string
+		wantGroup   *user.Group
+		wantMembers []string
+		wantErr     bool
+	}{
+		{
+			name:      "no members",
+			input:     "vma:x:1000:\n",
+			wantGroup: &user.Group{Name: "vma", Gid: "1000"},
+		},
+		{
+			name:        "one member",
+			input:       "sudo:x:27:alice",
+			wantGroup:   &user.Group{Name: "sudo", Gid: "27"},
+			wantMembers: []string{"alice"},
+		},
+		{
+			name:        "several members",
+			input:       "docker:x:998:alice,bob\n",
+			wantGroup:   &user.Group{Name: "docker", Gid: "998"},
+			wantMembers: []string{"alice", "bob"},
+		},
+		{
+			name:    "too few fields",
+			input:   "bad:x",
+			wantErr: true,
+		},
+		{
+			name:    "empty group name",
+			input:   ":x:1000:alice",
+			wantErr: true,
+		},
+		{
+			name:    "empty GID",
+			input:   "vma:x::alice",
+			wantErr: true,
+		},
+		{
+			name:    "empty input",
+			input:   "",
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			g, members, err := parseGroup(tt.input)
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantGroup.Name, g.Name, "group name")
+			assert.Equal(t, tt.wantGroup.Gid, g.Gid, "GID")
+			assert.Equal(t, tt.wantMembers, members, "members")
+		})
+	}
+}
+
+func TestGroupMembersFromFile(t *testing.T) {
+	tests := []struct {
+		name  string
+		entry string
+		want  []string
+	}{
+		{name: "no members", entry: "vma:x:1000:"},
+		{name: "only the owner", entry: "vma:x:1000:vma", want: []string{"vma"}},
+		{name: "two members", entry: "vma:x:1000:vma,bob", want: []string{"vma", "bob"}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "group")
+			body := "root:x:0:\n" + tt.entry + "\nsudo:x:27:vma\n"
+			require.NoError(t, os.WriteFile(path, []byte(body), 0o644), "write the group file")
+
+			members, err := groupMembersFromFile(path, "vma")
+			require.NoError(t, err, "entry %q", tt.entry)
+			assert.Equal(t, tt.want, members, "entry %q", tt.entry)
+		})
+	}
+}
+
+// A group the file does not describe, because it comes from LDAP or another
+// NSS source, is an error rather than an empty member list: the caller must
+// be able to tell "no members" from "no answer".
+func TestGroupMembersFromFileUnknownGroup(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "group")
+	require.NoError(t, os.WriteFile(path, []byte("root:x:0:\n"), 0o644), "write the group file")
+
+	_, err := groupMembersFromFile(path, "vma")
+	assert.Error(t, err, "a group the file does not describe")
+
+	_, err = groupMembersFromFile(filepath.Join(t.TempDir(), "absent"), "vma")
+	assert.Error(t, err, "no group file at all")
+}
+
+// GroupMembers on the root group, which every Unix has, whichever source
+// answers for it.
+func TestGroupMembers_RootGroup(t *testing.T) {
+	rootGroup := "root"
+	switch runtime.GOOS {
+	case "darwin", "dragonfly", "freebsd", "netbsd", "openbsd":
+		rootGroup = "wheel"
+	}
+
+	_, err := GroupMembers(rootGroup)
+	assert.NoError(t, err, "the %s group must be describable", rootGroup)
+}
+
+func TestValidateInput(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  bool
+	}{
+		{"normal username", "alice", true},
+		{"numeric UID", "1001", true},
+		{"dots and underscores", "alice.bob_test", true},
+		{"hyphen", "alice-bob", true},
+		{"leading hyphen rejected", "-i", false},
+		{"leading double hyphen rejected", "--no-idn", false},
+		{"lone hyphen rejected", "-", false},
+		{"kerberos principal", "user@REALM", true},
+		{"samba machine account", "MACHINE$", true},
+		{"NIS compat", "+user", true},
+		{"empty", "", false},
+		{"null byte", "alice\x00bob", false},
+		{"newline", "alice\nbob", false},
+		{"tab", "alice\tbob", false},
+		{"control char", "alice\x01bob", false},
+		{"DEL char", "alice\x7fbob", false},
+		{"space rejected", "alice bob", false},
+		{"semicolon rejected", "alice;bob", false},
+		{"backtick rejected", "alice`bob", false},
+		{"pipe rejected", "alice|bob", false},
+		{"33 chars exceeds non-linux max", makeLongString(33), runtime.GOOS == "linux"},
+		{"256 chars at linux max", makeLongString(256), runtime.GOOS == "linux"},
+		{"257 chars exceeds all limits", makeLongString(257), false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, validateInput(tt.input))
+		})
+	}
+}
+
+func makeLongString(n int) string {
+	b := make([]byte, n)
+	for i := range b {
+		b[i] = 'a'
+	}
+	return string(b)
+}
+
+func TestPasswdLookup_RootUser(t *testing.T) {
+	if _, err := exec.LookPath("getent"); err != nil {
+		t.Skip("getent not available on this system")
+	}
+
+	u, shell, err := passwdLookup("root")
+	require.NoError(t, err)
+	assert.Equal(t, "root", u.Username)
+	assert.Equal(t, "0", u.Uid)
+	assert.Equal(t, "0", u.Gid)
+	assert.NotEmpty(t, shell, "root should have a shell")
+}
+
+func TestPasswdLookup_ByUID(t *testing.T) {
+	if _, err := exec.LookPath("getent"); err != nil {
+		t.Skip("getent not available on this system")
+	}
+
+	u, _, err := passwdLookup("0")
+	require.NoError(t, err)
+	assert.Equal(t, "root", u.Username)
+	assert.Equal(t, "0", u.Uid)
+}
+
+func TestPasswdLookup_NonexistentUser(t *testing.T) {
+	if _, err := exec.LookPath("getent"); err != nil {
+		t.Skip("getent not available on this system")
+	}
+
+	_, _, err := passwdLookup("nonexistent_user_xyzzy_12345")
+	assert.Error(t, err)
+}
+
+func TestPasswdLookup_InvalidInput(t *testing.T) {
+	_, _, err := passwdLookup("")
+	assert.Error(t, err)
+
+	_, _, err = passwdLookup("user\x00name")
+	assert.Error(t, err)
+}
+
+func TestPasswdLookup_NotAvailable(t *testing.T) {
+	if _, err := exec.LookPath("getent"); err == nil {
+		t.Skip("getent is available, can't test missing case")
+	}
+
+	_, _, err := passwdLookup("root")
+	assert.Error(t, err, "should fail when getent is not installed")
+}
+
+func TestGroupLookup_RootGroup(t *testing.T) {
+	if _, err := exec.LookPath("getent"); err != nil {
+		t.Skip("getent not available on this system")
+	}
+
+	g, _, err := groupLookup("0")
+	require.NoError(t, err)
+	assert.Equal(t, "0", g.Gid, "GID 0 resolves to the root group")
+	assert.NotEmpty(t, g.Name, "the root group has a name")
+}
+
+func TestIdGroups_CurrentUser(t *testing.T) {
+	if _, err := exec.LookPath("id"); err != nil {
+		t.Skip("id not available on this system")
+	}
+
+	current, err := user.Current()
+	require.NoError(t, err)
+
+	groups, err := idGroups(current.Username)
+	require.NoError(t, err)
+	require.NotEmpty(t, groups, "current user should have at least one group")
+
+	for _, gid := range groups {
+		_, err := strconv.ParseUint(gid, 10, 32)
+		assert.NoError(t, err, "group ID %q should be a valid uint32", gid)
+	}
+}
+
+func TestIdGroups_NonexistentUser(t *testing.T) {
+	if _, err := exec.LookPath("id"); err != nil {
+		t.Skip("id not available on this system")
+	}
+
+	_, err := idGroups("nonexistent_user_xyzzy_12345")
+	assert.Error(t, err)
+}
+
+func TestIdGroups_InvalidInput(t *testing.T) {
+	_, err := idGroups("")
+	assert.Error(t, err)
+
+	_, err = idGroups("user\x00name")
+	assert.Error(t, err)
+}
+
+func TestGetentResultsMatchStdlib(t *testing.T) {
+	if _, err := exec.LookPath("getent"); err != nil {
+		t.Skip("getent not available on this system")
+	}
+
+	current, err := user.Current()
+	require.NoError(t, err)
+
+	getentUser, _, err := passwdLookup(current.Username)
+	require.NoError(t, err)
+
+	assert.Equal(t, current.Username, getentUser.Username, "username should match")
+	assert.Equal(t, current.Uid, getentUser.Uid, "UID should match")
+	assert.Equal(t, current.Gid, getentUser.Gid, "GID should match")
+	assert.Equal(t, current.HomeDir, getentUser.HomeDir, "home directory should match")
+}
+
+func TestGetentResultsMatchStdlib_ByUID(t *testing.T) {
+	if _, err := exec.LookPath("getent"); err != nil {
+		t.Skip("getent not available on this system")
+	}
+
+	current, err := user.Current()
+	require.NoError(t, err)
+
+	getentUser, _, err := passwdLookup(current.Uid)
+	require.NoError(t, err)
+
+	assert.Equal(t, current.Username, getentUser.Username, "username should match when looked up by UID")
+	assert.Equal(t, current.Uid, getentUser.Uid, "UID should match")
+}
+
+func TestIdGroupsMatchStdlib(t *testing.T) {
+	if _, err := exec.LookPath("id"); err != nil {
+		t.Skip("id not available on this system")
+	}
+
+	current, err := user.Current()
+	require.NoError(t, err)
+
+	stdGroups, err := current.GroupIds()
+	if err != nil {
+		t.Skip("os/user.GroupIds() not working, likely CGO_ENABLED=0")
+	}
+
+	idGroupIDs, err := idGroups(current.Username)
+	require.NoError(t, err)
+
+	// Deduplicate both lists: id -G can return duplicates (e.g., root in Docker)
+	// and ElementsMatch treats duplicates as distinct.
+	assert.ElementsMatch(t, uniqueStrings(stdGroups), uniqueStrings(idGroupIDs), "id -G should return same groups as os/user")
+}
+
+func uniqueStrings(ss []string) []string {
+	seen := make(map[string]struct{}, len(ss))
+	out := make([]string, 0, len(ss))
+	for _, s := range ss {
+		if _, ok := seen[s]; ok {
+			continue
+		}
+		seen[s] = struct{}{}
+		out = append(out, s)
+	}
+	return out
+}
@@ -0,0 +1,36 @@
+//go:build windows
+
+package getent
+
+import (
+	"errors"
+	"os/user"
+)
+
+// Windows does not use NSS or getent; os/user resolves accounts there
+// without cgo, so everything delegates to it.
+
+// LookupUser looks up a user by name.
+func LookupUser(username string) (*user.User, error) {
+	return user.Lookup(username)
+}
+
+// LookupUserID looks up a user by UID.
+func LookupUserID(uid string) (*user.User, error) {
+	return user.LookupId(uid)
+}
+
+// CurrentUser returns the user this process runs as.
+func CurrentUser() (*user.User, error) {
+	return user.Current()
+}
+
+// GroupIDs returns the IDs of the groups the user is a member of.
+func GroupIDs(u *user.User) ([]string, error) {
+	return u.GroupIds()
+}
+
+// UserShell is unanswerable on Windows, which has no login-shell database.
+func UserShell(string) (string, error) {
+	return "", errors.ErrUnsupported
+}
@@ -91,6 +91,12 @@ func SelfDelegatesTo() (Identity, bool) {
 	return selfIdentity, true
 }

+// The values PrivilegedActorKey returns.
+const (
+	ActorKeyAdministrator = "administrator"
+	ActorKeyRoot          = "root"
+)
+
 // PrivilegedActor names the principal a privileged operation requires, for use
 // in messages shown to the user.
 func PrivilegedActor() string {
@@ -100,6 +106,16 @@ func PrivilegedActor() string {
 	return "root"
 }

+// PrivilegedActorKey identifies that principal without wording it, for a client
+// that writes its own message in the user's language. The words PrivilegedActor
+// returns are English, and a translated sentence cannot borrow them.
+func PrivilegedActorKey() string {
+	if runtime.GOOS == "windows" {
+		return ActorKeyAdministrator
+	}
+	return ActorKeyRoot
+}
+
 // ElevatedCommand renders a command so that running it grants the privileges the
 // operation needs. Windows has no in-line equivalent of sudo, so the command is
 // returned unchanged and the user is expected to run it from an elevated
@@ -26,7 +26,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/portforward"
 	"github.com/netbirdio/netbird/client/internal/rosenpass"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
-	"github.com/netbirdio/netbird/client/netstate"
+	"github.com/netbirdio/netbird/client/netevents"
 	"github.com/netbirdio/netbird/route"
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
 )
@@ -95,9 +95,9 @@ type ConnConfig struct {
 	// ICEConfig ICE protocol configuration
 	ICEConfig icemaker.Config

-	// NetworkState gates the reconnection guard on OS-reported network
+	// NetMgr gates the reconnection guard on OS-reported network
 	// availability; nil disables gating.
-	NetworkState *netstate.State
+	NetMgr *netevents.Manager
 }

 type Conn struct {
@@ -259,7 +259,7 @@ func (conn *Conn) open(engineCtx context.Context, firstPacket []byte) error {
 		conn.handshaker.AddICEListener(conn.workerICE.OnNewOffer)
 	}

-	conn.guard = guard.NewGuard(conn.Log, conn.isConnectedOnAllWay, conn.config.Timeout, conn.srWatcher, conn.config.NetworkState)
+	conn.guard = guard.NewGuard(conn.Log, conn.isConnectedOnAllWay, conn.config.Timeout, conn.srWatcher, conn.config.NetMgr)

 	conn.wg.Add(1)
 	go func() {
@@ -6,8 +6,6 @@ import (

 	"github.com/cenkalti/backoff/v4"
 	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/netstate"
 )

 // ConnStatus represents the connection state as seen by the guard.
@@ -24,6 +22,12 @@ const (

 type connStatusFunc func() ConnStatus

+// NetworkWatcher is the availability view the guard gates reconnects on.
+type NetworkWatcher interface {
+	IsOnline() bool
+	Changed() <-chan struct{}
+}
+
 // Guard is responsible for the reconnection logic.
 // It will trigger to send an offer to the peer then has connection issues.
 // Watch these events:
@@ -37,22 +41,22 @@ type Guard struct {
 	isConnectedOnAllWay connStatusFunc
 	timeout             time.Duration
 	srWatcher           *SRWatcher
-	// netState gates reconnect attempts on OS-reported network availability;
+	// netWatcher gates reconnect attempts on OS-reported network availability;
 	// nil disables gating.
-	netState                *netstate.State
+	netWatcher              NetworkWatcher
 	relayedConnDisconnected chan struct{}
 	iCEConnDisconnected     chan struct{}
 }

-// NewGuard creates a reconnection guard for a peer connection. A nil netState
+// NewGuard creates a reconnection guard for a peer connection. A nil netWatcher
 // disables network availability gating.
-func NewGuard(log *log.Entry, isConnectedFn connStatusFunc, timeout time.Duration, srWatcher *SRWatcher, netState *netstate.State) *Guard {
+func NewGuard(log *log.Entry, isConnectedFn connStatusFunc, timeout time.Duration, srWatcher *SRWatcher, netWatcher NetworkWatcher) *Guard {
 	return &Guard{
 		log:                     log,
 		isConnectedOnAllWay:     isConnectedFn,
 		timeout:                 timeout,
 		srWatcher:               srWatcher,
-		netState:                netState,
+		netWatcher:              netWatcher,
 		relayedConnDisconnected: make(chan struct{}, 1),
 		iCEConnDisconnected:     make(chan struct{}, 1),
 	}
@@ -104,14 +108,17 @@ func (g *Guard) reconnectLoopWithRetry(ctx context.Context, callback func()) {
 	iceState := &iceRetryState{log: g.log}
 	defer iceState.reset()

-	netChanged := g.netState.Changed()
+	var netChanged <-chan struct{}
+	if g.netWatcher != nil {
+		netChanged = g.netWatcher.Changed()
+	}

 	for {
 		select {
 		case <-tickerChannel:
 			// skip attempts while the OS reports no usable network; the
 			// netChanged case below resumes the loop once it returns
-			if !g.netState.IsOnline() {
+			if g.netWatcher != nil && !g.netWatcher.IsOnline() {
 				continue
 			}
 			switch g.isConnectedOnAllWay() {
@@ -152,8 +159,8 @@ func (g *Guard) reconnectLoopWithRetry(ctx context.Context, callback func()) {

 		case <-netChanged:
 			// Re-arm for the next transition before acting on this one.
-			netChanged = g.netState.Changed()
-			if !g.netState.IsOnline() {
+			netChanged = g.netWatcher.Changed()
+			if !g.netWatcher.IsOnline() {
 				continue
 			}
 			// Ticks skipped while offline drove the backoff towards its
@@ -9,7 +9,7 @@ import (
 	log "github.com/sirupsen/logrus"

 	"github.com/netbirdio/netbird/client/internal/peer/ice"
-	"github.com/netbirdio/netbird/client/netstate"
+	"github.com/netbirdio/netbird/client/netevents/netstate"
 )

 // newTestGuardWithNetState builds a guard with a realistic MaxInterval: the