launch_socket_server for Mac

Problem: You want to accept connections on a port number under 1024 on OS X, but you don't want your server to run as root.

Solution: Run your server with _launch_socket_server_.

_launch_socket_server_ sits in between launchd(8) and your server, using the system's APIs to proxy incoming connections from a privileged port to your unprivileged program.

It uses the launch_activate_socket API, available on OS X 10.9 and higher.

_launch_socket_server_ can proxy incoming connections to a Unix domain socket or to a local TCP port. By default, _launch_socket_server_ generates the path to a domain socket and passes that path to your program in an environment variable.

To run your server with _launch_socket_server_, begin by creating a launch daemon.

Creating and configuring a conventional launch daemon

The following configuration sets up launchd to listen on port 80. _launch_socket_server_ activates the port, runs your server program, and proxies requests to it via a UNIX domain socket. Your server is responsible for reading the path to the domain socket from the LAUNCH_PROGRAM_SOCKET_PATH environment variable and accepting connections on that socket. Pick an identifier for your server. By convention, launch daemon identifiers start with the components of a domain name you control, in reverse order, followed by the name of your server. For this example, we will use an identifier of com.example.myserver. Create an XML plist file at /Library/LaunchDaemons/.plist, replacing _identifier_ in the pathname with your server's identifier. In the plist file, specify your server's identifier, tell it to execute when loaded, and request that launchd keeps it running. Specify the user and group you want to use to run your server program. Tell launchd where to redirect your server program's stdout and stderr. (Optional, but recommended.) Specify the path to the launch_socket_server executable, your server program, and any arguments you wish to pass to your server. Define a launch daemon socket with the address and port you want to listen on. (Note: The _SockServiceName_ value may be a port number, or the name of any service defined in /etc/services.)

Configuring your server to run with launch_socket_server

Update your server's configuration to bind to the UNIX domain socket specified in the LAUNCH_PROGRAM_SOCKET_PATH environment variable, if it is set. Your server must unlink the socket before binding if the socket already exists, and should unlink the socket when the program terminates.

For more information on using domain sockets, please see the documentation for your programming environment.

Note: Your server program must run in the foreground, not forked as a background process.

Manually specifying the path to the domain socket

If you wish to specify the path to the domain socket shared by _launch_socket_server_ and your program, you may set the LAUNCH_PROGRAM_SOCKET_PATH environment variable in the launch daemon plist file.