Alternatively, if you don't trust a large program with dropping root, you can factor out the binding and listening into a separate program. Then accepting and e

Alternatively, if you don't trust a large program with dropping root, you can factor out the binding and listening into a separate program. Then accepting and everything beyond can be done with normal privileges. Assuming a tcpserver-like program called tcplisten, this would look like sudo tcplisten 0.0.0.0 80 setuidgid nobody \ program-that-accepts-on-stdin FastCGI works similarly. Multiple workers can run underneath, calling accept(2) on stdin. A simple implementation of tcplisten: https://gist.github.com/4211098 https://gist.github.com/4211098