Inconsistent (confusing) use of variables in ProcessContainer.js in setuid/setgid code
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 43.3k
- Forks
- 2.7k
- PR merge metrics
- No merged PRs in 30d
Description
While trying to understand what was going on with https://github.com/Unitech/pm2/issues/5315 I noticed that in the code to process the --user and --gid parameters there seems to be some inconsistent - or at least confusing - use of variables:
https://github.com/Unitech/pm2/blob/da59cb6dd761546686e5f89dbc8126672d8b3460/lib/ProcessContainer.js#L87
https://github.com/Unitech/pm2/blob/da59cb6dd761546686e5f89dbc8126672d8b3460/lib/ProcessContainer.js#L89
https://github.com/Unitech/pm2/blob/da59cb6dd761546686e5f89dbc8126672d8b3460/lib/ProcessContainer.js#L91
The full code is
// uid/gid management
if (pm2_env.uid || pm2_env.gid) {
try {
if (process.env.gid) // <-------------- THIS
process.setgid(pm2_env.gid);
if (pm2_env.uid)
process.setuid(pm2_env.uid);
} catch(e) {
setTimeout(function() {
console.error('%s on call %s', e.message, e.syscall);
console.error('%s is not accessible', pm2_env.uid);
return process.exit(1);
}, 100);
}
}
exec(script, stds);
The initial if checks for pm2_env.uid and pm2_env.gid, while below it's checking of process.env.gid instead of pm2_env.gid, but it's using pm2_env.gid - are these (guaranteed to be) the same?
Additionally, there's some other oddities here:
- The error handling will never get to process.setuid() if process.setgid() fails - but the error logging is for setuid()
- If setuid() or setgid() fails then exec() will still be performed, but then apparently terminated 100 ms afterwards when the error is logged. What is the point of the setTimeout() here ??
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in lib/ProcessContainer.js at the uid/gid management block around the linked lines, and review the related context in issue #5315. Trace how pm2_env.gid, process.env.gid, setgid(), setuid(), exec(), and the delayed error handler interact. Done means the variable usage and failure behavior are clarified or corrected with appropriate validation of the affected process-start path.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- backend, cli
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100