.IR group ]
.RB [ \-a
.IR socket ]
+.RB [ \-m
+.IR mode ]
.RB [ \-T
.IR trace-opts ]
.br
administration socket.
.TP
.BI "\-G, \-\-setgid=" group
-Set gid to that of
+If the current effective uid is zero (i.e., the daemon was invoked as
+.BR root )
+then set gid to that of
.I group
-(either a group name or integer gid) after initialization.
+(either a group name or integer gid) after initialization. In any
+event, arrange hat the administration socket be owned by the given
+.IR group .
.TP
.BI "\-k, \-\-priv\-keyring=" file
Reads the private key from
.B "\*(/s/tripesock"
is used instead.
.TP
+.BI "\-m, \-\-admin\-perms=" mode
+Permissions (as an octal number) to set on the administration socket. The
+default is 600, which allows only the socket owner. Setting 660 allows
+members of the
+.I group
+configured through the
+.B \-G
+option to connect to the socket, which may be useful. Allowing world access
+is a terrible idea.
+.TP
.BI "\-T, \-\-trace=" trace-opts
Allows the enabling or disabling of various internal diagnostics. See
below for the list of options.