Is starting dnscrypt-proxy supported inside .app bundles on MacOS ?

[Saliom]

I am working on a bundled app on MacOS to be distributed and wanted to include dnscrypt-proxy functionnalities inside of it, but it doesn't seem possible to call the scripts with sudo from inside the .app bundle, is it clearly not supported or is there a possible workaround?

[jedisct1]

dnscrypt-proxy doesn't actually need sudo or root to run . The only reason you'd need elevated privileges is to bind to port 53, which is a privileged port on macOS.

If you need to run something as root from a .app bundle, the Apple-sanctioned way is to use a privileged helper installed via
SMAppService (or the older SMJobBless). That's how apps like Little Snitch and Lulu handle it. Calling sudo from inside a bundle is intentionally blocked by macOS. It's not a dnscrypt-proxy limitation.

Alternatively, you could ship a LaunchDaemon that runs dnscrypt-proxy on port 53 independently of your app, and just have your app talk to it over localhost. That's actually pretty close to how dnscrypt-proxy is typically deployed on macOS anyway.