Nodejs downgraded from root using setuid, but what about the owner of the log file?

Question

I roughly followed the scheme described at http://onteria.wordpress.com/2011/05/31/dropping-privileges-using-process-setuid-in-node-js/ , as a result of which I run node as the root user, and then redefine the user. That way I can listen to 80 without the need for a proxy. Pretty standard stuff. I have an upstart script to control the process (Ubuntu server).

The upstart script redirects stdout / err to the log file (which is owned by root). Inside, I use winston to enter the console and the file (which also belongs to root).

In my beautiful and happy world, I could transparently use log files (both redirected stdout / err, and one winston) for the downgraded user. I tried (naively) when I launched them from a node application that worked, but meant that they were never recorded again.

How can i achieve this? Is this possible or should I try to live with (at least some) of the log files owned by root?

Thank you very much!

Answer 1

What I did was a version of Peter Lyon's solution (I abbreviated "from several places", so it may not work, but the idea works):

var logger = new (winston.Logger)(); logger.add(winston.transports.Console, { timestamp: true }); // start server and downgrade user httpsServer.listen(443, function() { logger.info('Ready on port 443'); fs.stat(__filename, function(err, stats) { fs.chownSync('stdouterr.log',stats.uid,stats.gid); process.setgid(stats.gid); process.setuid(stats.uid); logger.add(winston.transports.File, { filename: 'mylogfile.log', handleExceptions: true }); logger.info('downgraded to non-root uid', {"uid":stats.uid}); }); }); 

When I successfully contacted port 443, I will write it down to say this. logger is a winston logger configured only with console output (which is redirected to the stdouterr.log file by running node using node app.js >> stdouterr.log 2>&1 ). Therefore, this log message only appears on stdouterr.log .

Then I consider the owner of the current file and chown stdouterr.log to belong to this user. Then I set the gid and uid of the current process (part of the privileges to delete).

Then I add registration to my winston logger to my file.

Finally, I can say that I lowered the user rating. This message appears in both stdouterr.log and mylogfile.log .

Not as pretty as I hoped (no file registration while the process runs as root), but this means that the log files are easily protected and managed.