Description

XadillaX

opened on Mar 7, 2016

Issue body actions

I saw os.homedir() is directly using uv_os_homedir and it has an strange feature.

See here for the feature.

It will check the environment variable first and then check for the real home directory.

And someone discussed here for the reason.

I wonder if this should check $HOME first? It's something of a UNIX tradition to be able to change your home directory on the fly. A problem with that is that getenv("HOME") is not MT-safe.

-- @bnoordhuis

But I think there's still a problem.

---

Consider one situation:

If I wrote a CLI program and it will write some log file on user's home directory.

Now I run the CLI like this:

$ sudo -u foo node mycli.js

It should write log file on /home/foo. But the problem is - os.homedir() still got process.env.HOME.

One solution is to edit /etc/sudoers:

# env_keep+="HOME MAIL"
# comment env_keep += "HOME"

And another method is using -i argument.

_For further reading you can go to this article. (It was written in Chinese by @Amunu)_

---

But I think why don't we wrote a os.realHomedir() or removing checking HOME in realhomedir()? Not all of us (normal developers) have the permission to access configuration files on our online servers.

Activity

1. mscdex

   added

   osIssues and PRs related to the os subsystem.Issues and PRs related to the os subsystem.

   on Mar 7, 2016
2. parox2014 commented on Mar 7, 2016

   

   parox2014

   on Mar 7, 2016

   More actions

   +1
3. cjihrig commented on Mar 7, 2016

   

   cjihrig

   on Mar 7, 2016

   Contributor

   More actions

   There is work going on in libuv/libuv#742 to get the current user's password file entry. This would bypass the HOME check.
4. XadillaX commented on Mar 7, 2016

   

   XadillaX

   on Mar 7, 2016

   ContributorAuthor

   More actions

   I wrote a package called real-homedir.

   Actrully it's a copy of uv_os_homedir() but remove checking getenv("HOME") for getting real home directory.

   So what I mean is that to replace os.homedir() or write a new function like os.realHomedir() for the situation above.

   @cjihrig
5. Fishrock123 commented on Mar 7, 2016

   

   Fishrock123

   on Mar 7, 2016

   Contributor

   More actions

   IIRC there was actually requests to use $HOME if it existed..
6. XadillaX commented on Mar 8, 2016

   

   XadillaX

   on Mar 8, 2016

   ContributorAuthor

   More actions

   @Fishrock123 Yeah I agree with $HOME.

   But I'm talking about the situation above like sudo -u foo node mycli.js. It's the situation which mutually exclusive with $HOME.

   How to solve it in Node.js and let developers be comfortable with it?
7. ngot commented on Mar 8, 2016

   

   ngot

   on Mar 8, 2016

   More actions

   +1. provide warning when sudo -u to get the os.homedir() maybe nice.
8. cjihrig

   added a commit that references this issue on Apr 12, 2016

   os: add userInfo() method

   d6e56fd
9. cjihrig commented on Apr 12, 2016

   

   cjihrig

   on Apr 12, 2016

   Contributor

   More actions

   Moving forward, you can use os.userInfo().homedir. It skips the environment variable check, and returns the information for the effective user.
10. cjihrig

    closed this as completedon Apr 12, 2016
11. jasnell

    added a commit that references this issue on Apr 26, 2016

    os: add userInfo() method

    e052096

Issue actions