我可以将非特权应用程序绑定到 Mac OS X 上的特权端口吗？
我正在编写一个服务器类型应用程序，该应用程序通常由用户运行，但需要绑定到特权 TCP 端口（502 - Modbus TCP）。端口号是行业标准，我的应用程序是模拟器，因此我无法真正更改为> 1024，因为大多数设备都针对此端口号进行了预编程并且无法更改。
“根 EUID 安全策略”可保护端口 502 免受除 root 之外的任何人的访问（请参阅 身份验证、授权和权限指南）。因此，当使用 ports < 时，对 CFSocketSetAddress 的调用会失败。 1024.
出于明显的安全原因，我试图避免以 root 身份运行我的模拟器应用程序。 沙盒可以解决这个问题，但我知道它仅在 10.7 Lion 中可用，我必须在 10.6 SL 中工作。
有人可以指出在这种情况下什么是端口访问的“最佳实践”，也许还有一些示例和进一步阅读的指示。
非常感谢
PS：我已经看过Apple的 更好的授权示例 但它已经有 5 年历史了，而且有点麻烦，涉及到一个由 launchd 运行的特权帮助工具。我希望有一个更好的解决方案，不涉及以 root 身份运行进程。
I am writing a server type application which is normally run by a user but needs to bind to a privileged TCP port (502 - Modbus TCP). The port number is industry standard and my app is a simulator, so I can't really change to >1024 as most devices are pre-programmed for this port number and can not be changed.
The "Root EUID Security Policy" protects port 502 from access by anyone but root (see Authentication, Authorization, and Permissions Guide ). Therefore, the call to CFSocketSetAddress fails when using ports < 1024.
I'm trying to avoid running my simulator app as root for obvious security reasons.
Sandboxing may overcome this problem but I understand it's only available in 10.7 Lion and I have to work in 10.6 SL.
Could someone please point out what would be considered "best practice" for port access in this instance and maybe some pointers to examples and further reading.
Many Thanks
PS: I have seen Apple's Better Authorization Sample but it is 5 years old and a bit cumbersome involving a privileged helper tool run by launchd. I'm hoping there is a better solution that doesn't involve running a process as root.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您可以使用 ipfw 来做到这一点；尝试此处了解它并
man ipfw了解更多详细信息。You may be able to do this with
ipfw; try here to learn about it andman ipfwfor more details.看看 Apache 的 https 启动方式……它以 root 身份启动足够长的时间以获取端口 80 / 443，然后从那时起以“apache”或“http”用户身份运行。
Look at the way Apache's https starts… it starts as root long enough to grab port 80 / 443, and then runs as an 'apache' or 'http' user from then on.