Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

setuid breaks local secure serving on linux

See original GitHub issue

When I add servor as a dev dependency and try run serve a local instance with the “–secure” flag (along with providing some server.key and server.crt files) I get an error at the line where you call process.setuid(501); stating:

UnhandledPromiseRejectionWarning: Error: EPERM, Operation not permitted If I remove that call, it passes effortlessly. Maybe there’s a reason to changing the process uid that I am not competent enough. Anyways - if it can be made explicit you are breaking some security laws, it should be allowed, I think. Moreover, the browser is warning me as well any time I hit my homepage.

Kudos, Kosta

Issue Analytics

State:
Created 3 years ago
Comments:5 (3 by maintainers)

Top GitHub Comments

1reaction

kostadinnmcommented, Mar 25, 2020

Confirmed: running servor --secure

0reactions

lukejacksonncommented, Mar 26, 2020

Ok thanks! I will add this update to the next release 🎉

Top Results From Across the Web

Howto prevent chgrp from clearing “setuid bit”?

Clearing SUID and SGID bits on chgrp (or chown ) is perfectly reasonable. It is a safety measure in order to prevent security...

7.4. Minimize Privileges - The Linux Documentation Project

Perhaps the most effective technique is to simply minimize the highest privilege granted. In particular, avoid granting a program root privilege if possible....

Linux Privilege Escalation Techniques using SUID

When the service starts, we call out bin/sh and we execute a command with bin/sh and the command we run is /root/root.txt >...

Linux Capabilities - HackTricks

Linux capabilities provide a subset of the available root privileges to a process. This effectively breaks up root privileges into smaller and distinctive ......

4.3. Securing Services Red Hat Enterprise Linux 7

This prevents remote users from gaining higher privileges by running a setuid program. Use this option on the client and the server side....