How to control the file ownership of a socket managed by launchd

file-permissionslaunchdsocket

I'm working on writing a daemon that talks to other daemons in the same project over UNIX sockets. For security purposes, it's critical that these daemons only talk amongst themselves (and can't, for example, be connected to by other processes).

I was planning on limiting this access through standard UNIX file ownership and modes. But I can't find anywhere in the launchd.plist documentation on how to control these!

Looking at existing services, you can specify a SockPathMode key, which takes a decimal mode; great. But how do I specify the actual user and group of the created socket? I notice that some of the sockets managed by launchd on my system are owned by root:daemon, some by root:wheel, and some (e.g., ssh-agent), by stouset:wheel. And yet I can't for the life of me determine how and where these ownerships are specified.

Best Answer

Here is the question that is related to this one: https://stackoverflow.com/questions/7984657/run-daemon-as-another-user-on-mac-os-x If a daemon is run as a dedicated user then all file descriptors and sockets will be owned by that user. Then just add restrictive access permissions to those descriptors.

Related Solutions

Ssh – Forward local port or socket file to remote socket file

Altough in the time, when the question was asked, it was really impossible, but it is possible nowadays.

You can to both: UNIX=>TCP and UNIX=>UNIX forwarding.

For example:

ssh \
  -R/var/run/mysql.sock:/var/run/mysql.sock \
  -R127.0.0.1:3306:/var/run/mysql.sock \
  somehost

It is possible since OpenSSH 6.7.

Linux – Sockets found by lsof but not by netstat

This can occur if you create a socket, but never connect() or bind() with it. Your best bet may be to strace (-fF) the application, and then cross-reference with the output of lsof to determine which sockets are causing the issue. As a bonus method of debugging: if you wrap your socket calls with debugging information and write them out to /dev/null, it'll appear in strace without giving you hilariously-large log files.

Best Answer

Related Solutions

Ssh – Forward local port or socket file to remote socket file

Linux – Sockets found by lsof but not by netstat

Related Topic