1

How can I allow reading specific root owned files by a non-root-user executed process?

I'm running node.js under Linux/Ubuntu. I do not want to run my process with root authorization, but must have readonly access a couple root owned files.

I currently can't read these files (certificate key files) unless I start the process via sudo node .... Apart from those files the process is well behaved, able to run successfully when started under its own application user id.

I am hoping that I can do something like setup a symbolic link for the files which set permissions to allow the application user id read authorization to them. Since the certificate files are automatically maintained and updated by a separate process, I would rather not touch or copy them.

... But any other types solutions in the category of "don't run as root" are welcome too.

Improve this question
3
  • What are these certificates securing? If your node.js server ever were compromised in any way, the hackers will be able to secure/sign content as if they were you.
    – Mike
    Mar 29, 2018 at 1:43
  • @Mike. They are authenticating TLS. I think that the same thing could be said about an Apache server the reads cert files to implement TLS. But I would be interested in a better way if you are hinting that there is one?
    – GaryL
    Mar 29, 2018 at 15:20
  • Actually Apache appears to have processes running under root and others under www-data on my system, so it can read the SSL certificates owned by root with no world read permissions without any problem. I am assuming it then spawns sub-processes owned by www-data to restrict access to the web server. Nginx also has no problem reading SSL certificate files. You might want to consider proxying your Node.js server through one of those and then you don't have to worry about providing read access to non-root users.
    – Mike
    Mar 31, 2018 at 21:11

2 Answers 2

Reset to default
3

You can add a new group that is nodeJS group, add user to the group than change group for the file and at the end change permission for group to read the file.

groupadd nodeJS
usermod userName -g nodeJS
link -s rootOwnedFile linkToRootOwnedFile
chgrp nodeJS linkToRootOwnedFile
chmod g+r linkToRootOwneFile
Improve this answer
1
  • Since the certificate files are automatically maintained and updated by a separate process the file permission may get reverted.
    – alvits
    Mar 28, 2018 at 23:45
3

This can actually be done with Access Control Lists. This way, even if the files are changed, new ones added, or permissions on the files changed, you will still be able to access them with the Node.js user. Just do the following on the parent directory of the certificates:

setfacl -Rm u:nodeJSUser:rX,d:u:nodeJSUser:rX /path/to/certificates

Substitute nodeJSUser for the actual user. The first part of the -m option will set the current ACLs, and everything after the comma will set the default for new files. -R makes it recursive.

Note, if the certificates are stored under a root-owned directory with no execution access (e.g. chmod 700), then this won't work. For example, if the certs are stored at /root/certs, since /root is chmod 700, no other users can access anything inside that directory, even if they have permission on the file itself. For this, you can bind mount this directory to another directory and access it from there.

mkdir /certs
mount --bind /certs /root/certs
setfacl -Rm u:nodeJSUser:rX,d:u:nodeJSUser:rX /certs
Improve this answer
1
  • I accepted the other answer, but this one looks good too. :)
    – GaryL
    Mar 29, 2018 at 20:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .