title: Can I bind an unprivileged application to privileged port on Mac OS X?
body: <p>I am writing a server type application which is normally run by a user but needs to bind to a privileged TCP port (502 - Modbus TCP). The port number is industry standard and my app is a simulator, so I can't really change to >1024 as most devices are pre-programmed for this port number and can not be changed.</p>
  
  <p>The "Root EUID Security Policy" protects port 502 from access by anyone but root (see <a href="https://developer.apple.com/library/mac/#documentation/security/Conceptual/AuthenticationAndAuthorizationGuide/Introduction/Introduction.html" rel="nofollow">Authentication, Authorization, and Permissions Guide</a>  ). Therefore, the call to CFSocketSetAddress fails when using ports &lt; 1024.</p>
  
  <p>I'm trying to avoid running my simulator app as root for obvious security reasons.
  Sandboxing may overcome this problem but I understand it's only available in 10.7 Lion and I have to work in 10.6 SL.</p>
  
  <p>Could someone please point out what would be considered "best practice" for port access in this instance and maybe some pointers to examples and further reading.</p>
  
  <p>Many Thanks</p>
  
  <p>PS: I have seen Apple's <a href="https://developer.apple.com/library/mac/#samplecode/BetterAuthorizationSample/Introduction/Intro.html" rel="nofollow">Better Authorization Sample</a> but it is 5 years old and a bit cumbersome involving a privileged helper tool run by launchd. I'm hoping there is a better solution that doesn't involve running a process as root.</p>