How to run a service as a user who can't delete or update or create a file

Posted by neeraj on Server Fault See other posts from Server Fault or by neeraj
Published on 2010-04-08T21:18:26Z Indexed on 2010/04/08 21:23 UTC
Read the original article Hit count: 382

Filed under:

Mongodb is a web based console to try out Mongodb.

I have created something similar to try out nodejs. In nodejs I am accepting user input and then I am performing eval on that command. Given the power of nodejs , someone from web console can create a file, delete files on the system or could execute 'rm -rf '.

I was thinking will it be okay if I run node as a user called node. This user node will not have any privilege to write anything, create anything or update anything. The only access this user will have is read access. Will that work or that is too much of risk.

What is a good strategy to handle such a situation?

© Server Fault or respective owner

Related posts about security