use unix socket for bitmask-helper local api

bitmask-vpn installs a daemon called bitmask-helper which exposes a http api to handle firewall up/down and openvpn connect/disconnect (only in macos)

this helper was listening on localhost, since it is meant to be only accessible to local processes we'v changed it to listen on a unix domain socket

branding/templates/qtinstaller/osx-data/post-install.go

@@ -45,8 +45,14 @@ const (
     <integer>5</integer>
     <key>Label</key>
     <string>{{ .Label }}</string>
-    <key>Program</key>
-    <string>{{ .Path }}/bitmask-helper</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>{{ .Path }}/bitmask-helper</string>
+        <string>-socket-uid</string>
+        <string>{{.Uid}}</string>
+        <string>-socket-gid</string>
+        <string>{{.Gid}}</string>
+    </array>
 </dict>
 </plist>`
 
@@ -59,6 +65,10 @@ const (
 	// -stage flag values
 	stagePre       = "preinstall"
 	stageUninstall = "uninstall"
+
+	// listening socket flag values
+	socketUid = "socket-uid"
+	socketGid = "socket-gid"
 )
 
 var (
@@ -78,6 +88,9 @@ var (
 
 	plistPath          string
 	launchdDaemonLabel string
+
+	uid int
+	gid int
 )
 
 func init() {
@@ -94,6 +107,9 @@ func init() {
 	flag.StringVar(&installerStage, stage, stageUninstall, usageStage)
 	flag.StringVar(&appName, appname, "", usageAppName)
 
+	flag.IntVar(&uid, socketUid, 0, "Helper unix socket UID")
+	flag.IntVar(&gid, socketGid, 0, "Helper unix socket GID")
+
 	flag.Parse()
 }
 
@@ -260,9 +276,13 @@ func generatePlist() (string, error) {
 	appPath := struct {
 		Path  string
 		Label string
+		Uid   int
+		Gid   int
 	}{
 		Path:  appBundlePath(),
 		Label: launchdDaemonLabel,
+		Uid:   uid,
+		Gid:   gid,
 	}
 
 	t, err := template.New("plist").Parse(plistTemplate)