Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am trying to run Node.js as an unprivileged user (dmitry in this case). Hoping someone can confirm or, as necessary, please elaborate upon what I'm seeing below.:

Using Ubuntu 12.04 and upstart, I wrote a job script that calls the following:

exec sudo -u dmitry /usr/bin/node /home/dmitry/node/linkskeeper/app.js >> /var/log/linkskeeper.sys.log 2>&1

This statement lives in a file called /etc/init/linkskeeper.conf and I invoke

$ sudo service linkskeeper start

When I examine the processes that this spawns, I see:

$ ps aux | grep node
root     28349  0.0  0.2  40908  1672 ?        Ss   16:51   0:00 sudo -u dmitry /usr/bin/node /home/dmitry/node/linkskeeper/app.js
dmitry   28350  2.1  2.1 641784 13268 ?        Sl   16:51   0:00 /usr/bin/node /home/dmitry/node/linkskeeper/app.js

It appears that the initial exec call spawns pid 28349 as root, which in turn spawns 28350 with the unprivileged account. If this is the correct narrative, it makes sense to me. Interestingly, reference [1] below says this should not work on EC2, but it seems to work just fine.

Then I adjust the exec command to:

exec su - dmitry -c '/usr/bin/node /home/dmitry/node/linkskeeper/app.js 2>&1 >> /home/dmitry/app.log'

I get the following:

$ ps aux | grep node
dmitry   28371  0.0  0.2  37952  1312 ?        Ss   16:57   0:00 su - dmitry -c /usr/bin/node /home/dmitry/node/linkskeeper/app.js 2>&1 >> /home/dmitry/app.log
dmitry   28372  0.0  0.2  19516  1712 ?        S    16:57   0:00 -su -c /usr/bin/node /home/dmitry/node/linkskeeper/app.js 2>&1 >> /home/dmitry/app.log
dmitry   28375  3.2  2.6 639748 15916 ?        Sl   16:57   0:00 /usr/bin/node /home/dmitry/node/linkskeeper/app.js

I don't understand what's going on here with pids 28371, 28372 and 28375. They're all owned by dmitry, and I don't understand the command listed for 28372, which begins with a dash.

I should note that the Node.js app seems to work fine with both invokations.

References: [1] http://stackoverflow.com/questions/8312171/can-i-run-node-js-with-low-privileges

share|improve this question
add comment

1 Answer

The -su line represents a login shell. You don't really need to have a login shell to run a single command. Exec is used to replace the current shell anyway. Use su without the hyphen or -l option and the -su line should go away.

E.g.:

# su jaroslav -c 'cowsay $USER: moo'

All processes are owned by dmitry because that is the purpose of su. It changes the user. Sudo is different because it always runs as root (I'm not exactly sure how it changes assumes different personalities, and how that is different from what su does).

share|improve this answer
    
Thank you @Ярослав! Dropping the dash (-) and not invoking a new login shell in the su command changes the command shown in process 28372 above to bash -c /usr/bin/node /home/dmitry/node/linkskeeper/app.js 2>&1 >> /home/dmitry/app.log, which makes more sense than the -su -c syntax that I don't understand at all. –  dimadima Nov 25 '12 at 18:13
    
when you say "You don't really need to have a login shell to run a single shell", do you mean "to run a single process or command"? –  dimadima Nov 25 '12 at 18:16
    
Nps. There is nothing odd about the syntax, it's like I meant to say, you don't need an extra shell to run a single command. –  Ярослав Рахматуллин Nov 25 '12 at 18:17
    
Finally, do you know if root forking a dmitry process (per the sudo example) is somehow more or less secure than the su variant? Thanks again. –  dimadima Nov 25 '12 at 18:17
    
I'm really no authority on security matters. One possible problem with sudo is that it allows an attacker to get root access using the user password and not the root password which is needed to become root with su. Apart from that I assume these two are equally secure. –  Ярослав Рахматуллин Nov 25 '12 at 18:20
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.