Node: os.homedir() doesn't respect setuid

Created on 18 Jun 2019  路  5Comments  路  Source: nodejs/node

  • Version: v8.10.0
  • Platform: Linux 4.15.18-15-pve #1 SMP PVE 4.15.18-40 x86_64 x86_64 x86_64 GNU/Linux
  • Subsystem: os


Expected os.homedir() to home directory of the current user as a string but when the current user changes via process.setuid() this directory still show the original user's home directory

doc os

Most helpful comment

  • Version: v8.10.0
  • Platform: Linux 4.15.18-15-pve #1 SMP PVE 4.15.18-40 x86_64 x86_64 x86_64 GNU/Linux
  • Subsystem: os

Expected os.homedir() to home directory of the _current_ user as a string but when the current user changes via process.setuid() this directory still show the original user's home directory

I understand the expectation, but at the same time, I would expect the opposite behavior--that changing the uid does not affect the home directory. Other languages seem to bear this out. Here's Python being run initially as root and then changing to an unprivileged user with a different home directory:

Python 2.7.10 (default, Feb 22 2019, 21:55:15) 
[GCC 4.2.1 Compatible Apple LLVM 10.0.1 (clang-1001.0.37.14)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import os
>>> from os.path import expanduser
>>> expanduser("~")
'/var/root'
>>> os.setuid(501)
>>> expanduser("~")
'/var/root'

Perhaps relevant explanation about why sudo preserves the home directory by default rather than adopting the home directory of the privileged user: https://askubuntu.com/a/338449/112895

All 5 comments

  • Version: v8.10.0
  • Platform: Linux 4.15.18-15-pve #1 SMP PVE 4.15.18-40 x86_64 x86_64 x86_64 GNU/Linux
  • Subsystem: os

Expected os.homedir() to home directory of the _current_ user as a string but when the current user changes via process.setuid() this directory still show the original user's home directory

I understand the expectation, but at the same time, I would expect the opposite behavior--that changing the uid does not affect the home directory. Other languages seem to bear this out. Here's Python being run initially as root and then changing to an unprivileged user with a different home directory:

Python 2.7.10 (default, Feb 22 2019, 21:55:15) 
[GCC 4.2.1 Compatible Apple LLVM 10.0.1 (clang-1001.0.37.14)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import os
>>> from os.path import expanduser
>>> expanduser("~")
'/var/root'
>>> os.setuid(501)
>>> expanduser("~")
'/var/root'

Perhaps relevant explanation about why sudo preserves the home directory by default rather than adopting the home directory of the privileged user: https://askubuntu.com/a/338449/112895

if that's the case, at least the documentation on os.homedir() should be updated to be precise and reflect that; save some other coders some time

(why didn't I think of the ~username trick...)

Take a look to his PR #28401

Did this issue get resolved?

The PR was merged so yes, this was indeed resolved. Closing, thanks for the ping.

Was this page helpful?
0 / 5 - 0 ratings

Related issues

jmichae3 picture jmichae3  路  3Comments

willnwhite picture willnwhite  路  3Comments

stevenvachon picture stevenvachon  路  3Comments

loretoparisi picture loretoparisi  路  3Comments

fanjunzhi picture fanjunzhi  路  3Comments