From fcd5e2dcf174b10713a8b491cf83fa7f639b0344 Mon Sep 17 00:00:00 2001 From: Viktor Liu Date: Wed, 16 Sep 2026 11:22:27 +0200 Subject: [PATCH] Read the MDM policy through the Loader API --- client/cmd/service_controller.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/client/cmd/service_controller.go b/client/cmd/service_controller.go index 6d1b3d760..7995fa056 100644 --- a/client/cmd/service_controller.go +++ b/client/cmd/service_controller.go @@ -124,7 +124,10 @@ func (p *program) Start(svc service.Service) error { // on a managed host it may be carrying the restriction, and treating it as // absent would serve every local account instead. func (p *program) listenRestricted() (*socketListener, *socketListener, error) { - policy, err := mdm.LoadPolicyWithError() + // A nil fetcher leaves the platform-native source authoritative, which is + // what a desktop daemon wants. This runs before the Server exists, so it + // cannot borrow the Loader the Server owns. + policy, err := mdm.NewLoader(nil).LoadWithError() if err != nil { return nil, nil, err }