Added downgradeToUser start option to allow safely running SocketCluster as root by downgrading to a user with fewer privileges after binding to ports.

Author: Jon

balancer.js

@@ -84,4 +84,4 @@ if (cluster.isMaster) {
       balancer.setWorkers(m.data);
     }
   });
-}
+}

index.js

@@ -69,6 +69,7 @@ SocketCluster.prototype._init = function (options) {
     storeController: null,
     rebootOnSignal: true,
     useSmartBalancing: false,
+    downgradeToUser: false,
     clusterEngine: 'iocluster'
   };
 
@@ -312,6 +313,7 @@ SocketCluster.prototype._initLoadBalancer = function () {
       checkStatusTimeout: this.options.connectTimeout * 1000,
       statusURL: this._paths.statusURL,
       statusCheckInterval: this.options.workerStatusInterval * 1000,
+      downgradeToUser: this.options.downgradeToUser,
       appBalancerControllerPath: this._paths.appBalancerControllerPath
     }
   });
@@ -536,8 +538,9 @@ SocketCluster.prototype._start = function () {
     self._ioCluster = new self._clusterEngine.IOCluster({
       stores: self.options.stores,
       dataKey: self._dataKey,
-      appStoreControllerPath: self._paths.appStoreControllerPath,
-      expiryAccuracy: self._dataExpiryAccuracy
+      expiryAccuracy: self._dataExpiryAccuracy,
+      downgradeToUser: self.options.downgradeToUser,
+      appStoreControllerPath: self._paths.appStoreControllerPath
     });
 
     self._ioCluster.on('error', function (err) {

scworker.js

@@ -45,6 +45,16 @@ SCWorker.prototype._init = function (options) {
   for (var i in options) {
     this.options[i] = options[i];
   }
+  
+  if (this.options.downgradeToUser && process.setuid) {
+    try {
+      process.setuid(this.options.downgradeToUser);
+    } catch (err) {
+      this._errorDomain.emit('error', new Error('Could not downgrade to user "' + this.options.downgradeToUser +
+        '" - Either this user does not exist or the current process does not have the permission' +
+        ' to switch to it.'));
+    }
+  }
 
   if (this.options.dataKey == null) {
     this.options.dataKey = crypto.randomBytes(32).toString('hex');
@@ -224,4 +234,4 @@ SCWorker.prototype.noticeHandler = function (notice) {
   this.emit(this.EVENT_NOTICE, notice);
 };
 
-module.exports = SCWorker;
+module.exports = SCWorker;

worker.js

@@ -50,4 +50,4 @@ process.on('message', function (m) {
       worker.handleMasterEvent(m.event);
     }
   }
-});
+});