@wuyuchentr/run-as-user

Drop privileges and run a function as another user. Requires root. POSIX-only (Linux, macOS).

Designed for daemon processes that start as root and want to drop to a lower-privileged user.

Install

npm install @wuyuchentr/run-as-user

Usage

const { runAs, isRoot } = require('@wuyuchentr/run-as-user');

runAs('nobody', () => {
  // This code runs as the 'nobody' user
  startServer();
});

Forms

// By username
runAs('www-data', () => { ... });
runAs('nobody', () => { ... });

// By UID
runAs(65534, () => { ... });

// By object (no /etc/passwd lookup)
runAs({ uid: 1000, gid: 1000 }, () => { ... });

Helpers

isRoot();  // → true if euid === 0

How it works

Resolves the target user via /etc/passwd, then in order:

1. initgroups() — set supplementary groups
2. setgid() — set primary group ID
3. setuid() — set user ID (permanent drop)

After setuid() the process cannot regain root. This is intentional.

Notes

• Only works on POSIX with setuid/setgid syscalls
• The target user must exist in /etc/passwd (unless using { uid, gid } form)
• { uid, gid } form skips supplementary group initialization