sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-12 08:29:06 +02:00
Code Issues Packages Projects Releases Wiki Activity

Apply the socket restriction before serving and fail closed on an unusable one

Browse Source
This commit is contained in:
Viktor Liu
2026-09-16 11:18:02 +02:00
parent 1a9ff226b3
commit f185b2e435
9 changed files with 262 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/cmd/service.go
+3 -2
View File
@@ -72,11 +72,12 @@ func init() {
serviceCmd.PersistentFlags().StringVar(&jsonSocket, "json-socket", defaultJSONSocket, "HTTP/JSON API socket address [unix|tcp]://[path|host:port]. Requires --enable-json-socket to serve. To persist, use: netbird service install --enable-json-socket --json-socket")
allowGroupDesc := `Restricts the daemon control socket and the JSON socket to the given group. ` +
`Local accounts outside it cannot connect at all, so nothing the daemon exposes is reachable from them. ` +
`Accounts outside it cannot connect at all, so nothing the daemon exposes is reachable from them. ` +
`On Windows the daemon's own account, LocalSystem and elevated administrators keep access regardless. ` +
`Takes a group name, or a numeric GID on Unix and a SID on Windows; ` +
`Unix accepts a single group, Windows a comma-separated list of groups or accounts. ` +
`Names are resolved when the service is installed, LDAP, SSSD and Active Directory groups included. ` +
`To persist, use: netbird service install --allow-group`
`To persist, use: netbird service install --allow-group <group>`
serviceCmd.PersistentFlags().StringSliceVar(&allowGroups, "allow-group", nil, allowGroupDesc)
rootCmd.PersistentFlags().StringVarP(&serviceName, "service", "s", defaultServiceName, "Netbird system service name")