svc · unix #104
bind
Assigns a local protocol address to an unbound socket.
Prototype
int bind(int s, caddr_t name, socklen_t namelen);Returns: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| s | int | - | |
| name | caddr_t | - | |
| namelen | socklen_t | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-1456.1.26 | macOS 10.6 Snow Leopard | 104 |
| xnu-1486.2.11 | — | 104 |
| xnu-1504.15.3 | — | 104 |
| xnu-1504.3.12 | — | 104 |
| xnu-1504.7.4 | — | 104 |
| xnu-1504.9.17 | — | 104 |
| xnu-1504.9.26 | — | 104 |
| xnu-1504.9.37 | — | 104 |
Examples
Bind a TCP listener to localhost:8080
struct sockaddr_in sa = {
.sin_len = sizeof(sa),
.sin_family = AF_INET,
.sin_port = htons(8080),
.sin_addr.s_addr = htonl(INADDR_LOOPBACK),
};
if (bind(fd, (struct sockaddr *)&sa, sizeof(sa)) < 0) perror("bind");Notes
For AF_INET/AF_INET6 the kernel walks the inpcb hash and rejects collisions unless SO_REUSEPORT or SO_REUSEADDR is set. Binding to a privileged port (<1024) requires root or the com.apple.private.network.socket-delegate entitlement on modern macOS — App Sandbox can also block bind() on wildcard addresses. AF_UNIX bind creates a filesystem node and is therefore subject to sandbox path policy and TCC if the directory is protected.
Detection
No direct ES event. NetworkExtension's NEFilterPacketProvider sees the first outbound packet but not bind itself. The most reliable tap is a sysctl net.inet.tcp.pcblist diff combined with proc_listfds polling.