Mailing Lists: Apple Mailing Lists
Image of Mac OS face in stamp
 
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Error -3212 ???

> Now in classic everything works fines, but when it try to run on X I get an
> error while binding the listener connection (ip =0, port=605, my listening
> port). The docs are not very helpful of the -3212 error (kEACCESErr) I get.

Mac OS X, like other Unix-based systems, requires a process to have root
access to open port numbers below 1024. This has been debated at length and
it isn't going to change. Those ports are are to be used by "system"
services and the idea is that only someone who is authorized can install or
start the code that provides (or pretends to provide) a system service. You
wouldn't want to give your name and password to an FTP process on a machine
if you couldn't be sure it was the real FTP process.

One solution is to have your app installed with root as the owner and the
set-user-ID-on-execution bit set. This is hazardous if your app provides UI
because, among other things, it would allow any recent application in the
Apple menu to be launched inheriting your app's root access. This could be
done by any user who is allowed to launch your app whether or not they have
admin privileges. This also requires your app to be Mach-o, not CFM. CFM
apps are launched by the LaunchCFM app tool and it doesn't honor the
set-user-ID-on-execution bit.

Apple suggests you have your app launch a tool that opens the port. The
tool instead of your whole app would run as root. You'll need to figure out
how to talk to the tool from your main app, but there are lots of choices
for IPC on Mac OS X.

To set the set-user-ID-on-execution bit and get the owner set to root for
the tool (or for your app), you could use the Terminal window, but I suspect
you won't want your users to do that. I understand Apple's package
installer can set the bit and owner, but I don't know the details and have
never tried it.

Another choice is to use AuthorizationExecuteWithPrivileges in
Authorization.h in the Security.framework. Apple suggests using
AuthorizationExecuteWithPrivileges to launch yet another tool that then sets
set-user-ID-on-execution and changes the owner of the port-opening tool.

They discourage developers from launching port-opening tools directly with
AuthorizationExecuteWithPrivileges because it creates a security hole.
Someone could replace the port-opening tool long after installation and your
app would blindly execute the foreign code with root access.

If your server has no UI and can limit itself to the part of Carbon in
CoreServices.framework, you could also consider having it launched by a
StartupItem. StartupItems run with root privilege. For more information,
open the Help Viewer, click Developer Help Center, type Startup Items into
the search area, and click Ask. For examples, look at
/System/Library/StartupItems.

By the way, port 605 is listed as unassigned at www.iana.org. Are they out
of date or have you not registered it? If you aren't tied to that port, you
could also solve the problem by picking a port number above 1024.

Good luck!

-Marc

Marc Epard
Netopia, Inc.

References: 
 >Error -3212 ??? (From: Gabriel Beauchemin <email@hidden>)



Visit the Apple Store online or at retail locations.
1-800-MY-APPLE

Contact Apple | Terms of Use | Privacy Policy

Copyright © 2007 Apple Inc. All rights reserved.