How can I allow reading specific root owned files by a non-root-user executed process?

I'm running node.js under Linux/Ubuntu. I do not want to run my process with root authorization, but must have readonly access a couple root owned files.

I currently can't read these files (certificate key files) unless I start the process via sudo node .... Apart from those files the process is well behaved, able to run successfully when started under its own application user id.

I am hoping that I can do something like setup a symbolic link for the files which set permissions to allow the application user id read authorization to them. Since the certificate files are automatically maintained and updated by a separate process, I would rather not touch or copy them.

... But any other types solutions in the category of "don't run as root" are welcome too.

migrated from stackoverflow.com Apr 15 '18 at 12:29

This question came from our site for professional and enthusiast programmers.

  • What are these certificates securing? If your node.js server ever were compromised in any way, the hackers will be able to secure/sign content as if they were you. – Mike Mar 29 '18 at 1:43
  • @Mike. They are authenticating TLS. I think that the same thing could be said about an Apache server the reads cert files to implement TLS. But I would be interested in a better way if you are hinting that there is one? – GaryL Mar 29 '18 at 15:20
  • Actually Apache appears to have processes running under root and others under www-data on my system, so it can read the SSL certificates owned by root with no world read permissions without any problem. I am assuming it then spawns sub-processes owned by www-data to restrict access to the web server. Nginx also has no problem reading SSL certificate files. You might want to consider proxying your Node.js server through one of those and then you don't have to worry about providing read access to non-root users. – Mike Mar 31 '18 at 21:11

You can add a new group that is nodeJS group, add user to the group than change group for the file and at the end change permission for group to read the file.

groupadd nodeJS
usermod userName -g nodeJS
link -s rootOwnedFile linkToRootOwnedFile
chgrp nodeJS linkToRootOwnedFile
chmod g+r linkToRootOwneFile
  • Since the certificate files are automatically maintained and updated by a separate process the file permission may get reverted. – alvits Mar 28 '18 at 23:45

This can actually be done with Access Control Lists. This way, even if the files are changed, new ones added, or permissions on the files changed, you will still be able to access them with the Node.js user. Just do the following on the parent directory of the certificates:

setfacl -Rm u:nodeJSUser:rX,d:u:nodeJSUser:rX /path/to/certificates

Substitute nodeJSUser for the actual user. The first part of the -m option will set the current ACLs, and everything after the comma will set the default for new files. -R makes it recursive.

Note, if the certificates are stored under a root-owned directory with no execution access (e.g. chmod 700), then this won't work. For example, if the certs are stored at /root/certs, since /root is chmod 700, no other users can access anything inside that directory, even if they have permission on the file itself. For this, you can bind mount this directory to another directory and access it from there.

mkdir /certs
mount --bind /certs /root/certs
setfacl -Rm u:nodeJSUser:rX,d:u:nodeJSUser:rX /certs
  • I accepted the other answer, but this one looks good too. :) – GaryL Mar 29 '18 at 20:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.