OSX Mavericks: How can I make a webserver launch at boot and listen to port 80 without running the webserver as root?

Question

According to Apple's launchd documentation:

[launchd] Eliminates the primary reason for running daemons as root. Because launchd runs as root, it can create low-numbered TCP/IP listen sockets and hand them off to the daemon.

That's good ... but how?

I want to do the following:

• start the Nginx webserver at boot time
• have it listen to port 80
• have it run as the _www user

which is exactly the scenario the above documentation is talking about. But I haven't found a way to do it that doesn't give me a bind() to 0.0.0.0:80 failed (13: Permission denied) error message.

Here's the .plist file I have at /Systems/Library/LaunchDemons/homebrew.mxcl.nginx.plist:

<!--
Adapted from the .plist file provided as part of
the Mac Homebrew distribution of nginx.
-->

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>


<!-- 
Here's the problem!!

    <key>Username</key>
    <string>_www</string>

-->

<!--
I thought that Sock(et) declarations would be
the way to tell launchd to hand off a port to the
daemon. So I added these lines, but they don't
appear to make any difference at all.
-->

    <key>SockServiceName</key>
    <string>http</string>

    <key>SockType</key>
    <string>stream</string>

    <key>SockFamily</key>
    <string>IP4</string>

    <key>Label</key>
    <string>homebrew.mxcl.nginx</string>

    <key>RunAtLoad</key>
    <true/>

    <key>KeepAlive</key>
    <false/>

    <key>StandardOutputPath</key>
    <string>/var/log/nginx.log</string>

    <key>StandardErrorPath</key>
    <string>/var/log/nginx.log</string>

    <key>ProgramArguments</key>
    <array>
      <string>/usr/local/opt/nginx/bin/nginx</string>
    </array>

    <key>WorkingDirectory</key>
    <string>/usr/local</string>

  </dict>
</plist>

As you can see, the Username: _www is commented out. So when I run launchd as root, nginx runs as root, and everything works fine. But when I include the Username: _www declaration, nginx fails and leaves this error message in the logfile:

nginx: [emerg] bind() to 0.0.0.0:80 failed (13: Permission denied)

What am I missing?

Answer 1

A daemon needs to "get" the socket bound by launchd (e.g.: launch_data_get_fd) - it needs to be launchd-aware and implement some logic internally. AFAIK that's not the case for nginx, so I suggest one of the following options:

• Adjust the nginx port to be > 1024, then setup your firewall to redirect traffic from/to port 80 to/from the nginx port;
• Let the launchd run nginx as root and make nginx drop its privileges afterwards by changing the user directive on its configuration file;