Operation not permitted on xpc_listener_create

Hi,

I'm trying to create a launch daemon that uses XPC to receive requests from an unprivileged app. Ultimately both components will be written in Go. For now I'm trying to write a PoC in Objective-C to make sure I get everything right, so I'm compiling / signing from the CLI, and writing plist files by hand -- I'm not using XCode.

My current daemon code is pretty much the same as the boilerplate code that XCode generates when creating a new 'XPC Service':

#import <stdio.h>
#include <xpc/xpc.h>

int main(int argc, char *argv[]) {
	xpc_rich_error_t error;
    
    dispatch_queue_t queue = dispatch_queue_create("com.foobar.daemon", DISPATCH_QUEUE_SERIAL);

	xpc_listener_t listener = xpc_listener_create(
		"com.foobar.daemon",
		queue,
		XPC_LISTENER_CREATE_NONE,
		^(xpc_session_t _Nonnull peer) {
			xpc_session_set_incoming_message_handler(peer, ^(xpc_object_t _Nonnull message) {
            int64_t firstNumber = xpc_dictionary_get_int64(message, "firstNumber");
            int64_t secondNumber = xpc_dictionary_get_int64(message, "secondNumber");
            
            // Create a reply and send it back to the client.
            xpc_object_t reply = xpc_dictionary_create_reply(message);
            xpc_dictionary_set_int64(reply, "result", firstNumber + secondNumber);
            xpc_rich_error_t replyError = xpc_session_send_message(peer, reply);
            if (replyError) {
                printf("Reply failed, error: %s", xpc_rich_error_copy_description(replyError));
            }
			});
		},
		&error);
    
    if (error != NULL) {
        printf("ERROR: %s\n", xpc_rich_error_copy_description(error));
        exit(1);
    }
    
    printf("Created listener: %s", xpc_listener_copy_description(listener));
    
    // Resuming the serviceListener starts this service. This method does not return.
    dispatch_main();

	return 0;
}

I'm compiling, signing and installing my daemon with the following commands:

build_foobar() {
    clang -Wall -x objective-c -o com.foobar.daemon poc/main.m

    codesign --force --verify --verbose --options=runtime \
        --identifier="com.foobar.daemon" \
        --sign="Mac Developer: Albin Kerouanton (XYZ)" \
        --entitlements=poc/entitlements.plist \
        com.foobar.daemon
}

install_foobar() {
    sudo cp com.foobar.daemon /Library/PrivilegedHelperTools/com.foobar.daemon
    sudo cp poc/com.foobar.daemon.plist /Library/LaunchDaemons/com.foobar.daemon.plist
    sudo launchctl bootout system/com.foobar.daemon || true
    sudo launchctl bootstrap system /Library/LaunchDaemons/com.foobar.daemon.plist
}

Here's the content of my entitlements.plist file:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.application-identifier</key>
    <string>ABCD.com.foobar.daemon</string>
</dict>
</plist>

And finally, here's my launchd plist file:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>Label</key>
        <string>com.foobar.daemon</string>
        <key>Program</key>
        <string>/Library/PrivilegedHelperTools/com.foobar.daemon</string>
        <key>ProgramArguments</key>
        <array>
            <string>/Library/PrivilegedHelperTools/com.foobar.daemon</string>
        </array>
        <key>RunAtLoad</key>
        <false/>
        <key>StandardOutPath</key>
        <string>/tmp/com.foobar.daemon.out.log</string>
        <key>StandardErrorPath</key>
        <string>/tmp/com.foobar.daemon.err.log</string>
        <key>Debug</key>
        <true/>
    </dict>
</plist>

Whenever I start my service using sudo launchctl start com.foobar.daemon, it exits with the following error message:

ERROR: Unable to activate listener: failed at listener activation with error 1 - Operation not permitted

System logs don't show anything interesting -- they're just repeating the same error message. I tried to add / remove some properties from both the entitlement and the launchd plist file but to no avail.

Any idea what's going wrong?