Restrict socket access

README.md

@@ -34,3 +34,5 @@ Enable and start the service (otherwise you won't be able to change any settings
 sudo systemctl enable --now lactd
 ```
 You can now use the application.
+
+Note: only members of the group `wheel` can change settings.

daemon/src/lib.rs

@@ -54,10 +54,16 @@ impl Daemon {
         let listener = UnixListener::bind(SOCK_PATH).unwrap();
 
         Command::new("chmod")
-            .arg("666")
+            .arg("664")
             .arg(SOCK_PATH)
             .output()
             .expect("Failed to chmod");
+        
+        Command::new("chown")
+            .arg("nobody:wheel")
+            .arg(SOCK_PATH)
+            .output()
+            .expect("Failed to chown");
 
         let config_path = PathBuf::from("/etc/lact.json");
         let mut config = if unprivileged {