运行时Node.JS切换用户

Question

Is it possible for a Node.JS program that is running as root, to downgrade its authority while it is running? This would be one of the first things it does, and the purpose is of course to limit possible damage it could cause, in the unlikely event that there is a vulnerability, or mis-trusted code that runs in this process.

Alternatively, is there a way for Node.JS process that is running as root, to start a separate process which is non-root? (preferably without adding a layer in between, such as sudo)

Answer 1

尝试使用process.setuid（同样，也可以使用process.setgid） 。

Answer 2

是的，使用process.setuid（id）和process.setguid（id）更改当前进程的有效用户/组ID。

Answer 3

@mabako's answer looks great, but there should be operating system tricks that are easier.

What I've seen people do a lot with node is to either

1. Add the user that runs the node code to the www-data group to allow it to bind to privileged ports.

   ex: http://kvz.io/blog/2009/12/15/run-nodejs-as-a-service-on-ubuntu-karmic/

2. Use iptables to redirect privileged ports to an unprivileged node program, which listens on a high port.

   iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3000

Do you have any non-port-binding reasons to run a node server as root?

EDIT: More tricks here: Is there a way for non-root processes to bind to "privileged" ports on Linux?