I have written a flash socket security file server in PHP. The basic idea is that when Flash Player connects via socket to a server, the first thing it does is connect to port 843 and send a request for a 'socket policy file' by sending the string <policy-file-request/>.

The problem I have is that in order to launch this daemon script, I apparently need root level access in order to bind a socket to any port under 1024.

Can anyone recommend some way to let this php script bind to port 843 without needing root-level access? That seems like a big security risk to me -- especially if I want to launch this daemon using a php page hosted by apache. giving apache root-level access sounds like a VERY BAD idea.

Sadly, you are likely stuck starting up as root.

Other daemons start up as root, then listen to their < 1024 port, then they change user id to the user that they are supposed to be for the rest of the session.

The only other easy alternative is to choose a higher port number.

Thanks for your response.

Unfortunately, Flash is hard-wired to connect to 843 when looking for a socket policy file. If it fails to find a server on that port, it will try to find a policy file on the port it is trying to connect to, so you can build policy file handling into your application. This doesn't really work for me as I have written an AMF3-based protocol for my application server and to get a string that says "<policy-file-request>" rather than a 4-byte length indicator makes things pretty complicated.

That approach you describe sounds like something I eventually must do. I'd like the policy server daemon to be like Apache or MySQL in that it starts up when the machine reboots -- so you don't have to manually start it, etc.

Can you point me toward any resources which might explain how I could set up my script as a startup daemon which runs as root and then relinquishes its permissions?

Does Flash send a full HTTP request surrounding <policy-file-request/> ? Or just the string itself? If it's a full HTTP request, could you configure your Apache to load an additional VHost, which listens on Port 843? If so, create a small CGI script that always returns your policy file.

It is not a full http request. It is only "<policy-file-request>".

One way, if you use Solaris or OpenSolaris, would be to grant limited privileges to the process. In your case, that would be PRIV_NET_PRIVADDR.