systemd: Limit system manager socket permissions

Remove group permission on the system manager socket so that restricted
clients cannot use it to get unrestricted access. It is assumed that the
session manager system service (wireplumber) is running as pipewire user
and will get access to the manager socket, while other clients are
members of the pipewire group and will only get access to the normal
socket.

src/daemon/systemd/system/meson.build

@@ -3,7 +3,7 @@ if get_option('systemd-system-unit-dir') != ''
   systemd_system_services_dir = get_option('systemd-system-unit-dir')
 endif
 
-install_data(sources : 'pipewire.socket',
+install_data(sources : ['pipewire.socket', 'pipewire-manager.socket'],
              install_dir : systemd_system_services_dir)
 
 systemd_config = configuration_data()

src/daemon/systemd/system/pipewire-manager.socket

@@ -0,0 +1,13 @@
+[Unit]
+Description=PipeWire Multimedia System Manager Socket
+
+[Socket]
+Service=pipewire.service
+Priority=6
+ListenStream=%t/pipewire/pipewire-0-manager
+SocketUser=pipewire
+SocketGroup=pipewire
+SocketMode=0600
+
+[Install]
+WantedBy=sockets.target

src/daemon/systemd/system/pipewire.service.in

@@ -31,5 +31,5 @@ User=pipewire
 Environment=PIPEWIRE_RUNTIME_DIR=%t/pipewire
 
 [Install]
-Also=pipewire.socket
+Also=pipewire.socket pipewire-manager.socket
 WantedBy=default.target

src/daemon/systemd/system/pipewire.socket

@@ -1,10 +1,9 @@
 [Unit]
-Description=PipeWire Multimedia System Sockets
+Description=PipeWire Multimedia System Socket
 
 [Socket]
 Priority=6
 ListenStream=%t/pipewire/pipewire-0
-ListenStream=%t/pipewire/pipewire-0-manager
 SocketUser=pipewire
 SocketGroup=pipewire
 SocketMode=0660