sockets: implement WithAdditionalUsersAndGroups for windows

- Implement a WithAdditionalUsersAndGroups (windows daemon allows
  specifying multiple additional users and groups for named pipes
  and unix-sockets).
- Implement NewUnixSocket that accepts (optional) additional users
  and groups.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Author: thaJeztah

sockets/unix_socket_windows.go

@@ -1,6 +1,105 @@
 package sockets
 
-import "net"
+import (
+	"errors"
+	"fmt"
+	"net"
+	"strings"
+
+	"github.com/Microsoft/go-winio"
+	"golang.org/x/sys/windows"
+)
+
+// DefaultPermissions defines the default DACL, which allows Administrators
+// and LocalSystem full access (similar to defaults used in [moby]);
+//
+// - D:P: DACL without inheritance (protected, (P)).
+// - (A;;GA;;;BA): Allow full access (GA) for built-in Administrators (BA).
+// - (A;;GA;;;SY); Allow full access (GA) for LocalSystem (SY).
+// - Any other user is denied access.
+//
+// [moby]: https://github.com/moby/moby/blob/6b45c76a233b1b8b56465f76c21c09fd7920e82d/daemon/listeners/listeners_windows.go#L53-L59
+const DefaultPermissions = "D:P(A;;GA;;;BA)(A;;GA;;;SY)"
+
+// WithAdditionalUsersAndGroups modifies the socket file's DACL to grant
+// access to additional users and groups.
+//
+// By default, it grants [DefaultPermissions], but allows for additional
+// users and groups to get generic read (GR) and write (GW) access. It
+// returns an error when failing to resolve any of the additional users
+// and groups, or when failing to apply the ACL.
+func WithAdditionalUsersAndGroups(sids []string) SockOption {
+	return func(path string) error {
+		if len(sids) == 0 {
+			return errors.New("no additional users specified")
+		}
+		sd, err := getSecurityDescriptor(sids)
+		if err != nil {
+			return fmt.Errorf("looking up SID: %w", err)
+		}
+		return applySecurityDescriptor(path, sd)
+	}
+}
+
+// NewUnixSocket creates a unix socket.
+//
+// By default, it grants [DefaultPermissions], but allows for additional
+// users and groups to get generic read (GR) and write (GW) access. It
+// returns an error when failing to resolve any of the additional users
+// and groups, or when failing to apply the ACL.
+func NewUnixSocket(path string, additionalUsersAndGroups []string) (net.Listener, error) {
+	return NewUnixSocketWithOpts(path, WithAdditionalUsersAndGroups(additionalUsersAndGroups))
+}
+
+// getSecurityDescriptor returns the DACL for the Unix socket.
+//
+// By default, it grants [DefaultPermissions], but allows for additional
+// users and groups to get generic read (GR) and write (GW) access. It
+// returns an error when failing to resolve any of the additional users
+// and groups.
+func getSecurityDescriptor(additionalUsersAndGroups []string) (*windows.SECURITY_DESCRIPTOR, error) {
+	sddl := DefaultPermissions
+
+	// Grant generic read (GR) and write (GW) access to whatever
+	// additional users or groups were specified.
+	for _, g := range additionalUsersAndGroups {
+		sid, err := winio.LookupSidByName(strings.TrimSpace(g))
+		if err != nil {
+			return nil, fmt.Errorf("looking up SID: %w", err)
+		}
+		sddl += fmt.Sprintf("(A;;GRGW;;;%s)", sid)
+	}
+	sd, err := windows.SecurityDescriptorFromString(sddl)
+	if err != nil {
+		return nil, fmt.Errorf("parsing SDDL: %w", err)
+	}
+	return sd, nil
+}
+
+func applySecurityDescriptor(path string, sd *windows.SECURITY_DESCRIPTOR) error {
+	dacl, defaulted, err := sd.DACL()
+	if err != nil {
+		return fmt.Errorf("extracting DACL: %w", err)
+	}
+	// These should never be hit with our [DefaultPermissions] as start,
+	// as it contains "D:" and "P" (protected, don't inherit)/
+	if dacl == nil || defaulted {
+		return errors.New("no DACL found in security descriptor or defaulted")
+	}
+	group, _, err := sd.Group()
+	if err != nil {
+		return fmt.Errorf("extracting group SID: %w", err)
+	}
+	return windows.SetNamedSecurityInfo(
+		path,
+		windows.SE_FILE_OBJECT,
+		windows.DACL_SECURITY_INFORMATION|windows.OWNER_SECURITY_INFORMATION,
+		nil,   // keep SYSTEM as owner.
+		group, // group may be nil if no extra groups are specified.
+		dacl,
+		nil,
+	)
+}
 
 func listenUnix(path string) (net.Listener, error) {
 	return net.Listen("unix", path)