How to fix Error: setgid EPERM (operation not permitted, group change failed) in Node.js

// ❌ WRONG - This will fail with EPERM
process.setuid('nobody');
process.setgid('nobody'); // Error: setgid EPERM

// ✅ CORRECT - This will work
process.setgid('nobody');
process.setuid('nobody');

# Check if running as root
id
# Output should show uid=0(root)

# Or check process capabilities
getcap /usr/bin/node
# Should show cap_setgid capability if set

const http = require('http');

// Bind to privileged port while root
const server = http.createServer((req, res) => {
  res.end('Hello');
});

server.listen(80, () => {
  console.log('Server bound to port 80');

  // Drop privileges AFTER binding (correct order)
  try {
    process.setgid('www-data');
    process.setuid('www-data');
    console.log('Privileges dropped successfully');
  } catch (err) {
    console.error('Failed to drop privileges:', err);
    process.exit(1);
  }
});

# Check if group exists
getent group nobody
# Should output: nobody:x:65534:

# List all groups
cat /etc/group | grep nobody

// Verify GID exists before using it
const gid = 1000;
try {
  process.setgid(gid);
} catch (err) {
  if (err.code === 'EPERM') {
    console.error(`Cannot change to GID ${gid}: Permission denied`);
  }
}

[Unit]
Description=Node.js Application

[Service]
Type=simple
User=nodejs
Group=nodejs
ExecStart=/usr/bin/node /path/to/app.js

[Install]
WantedBy=multi-user.target

pm2 start app.js --user nodejs --group nodejs

function dropPrivileges(user, group) {
  if (!process.getuid || process.getuid() !== 0) {
    console.log('Not running as root, skipping privilege drop');
    return;
  }

  try {
    // Check if we can change groups
    console.log(`Attempting to change group to: ${group}`);
    process.setgid(group);
    console.log(`Group changed to: ${process.getgid()}`);

    // Then change user
    console.log(`Attempting to change user to: ${user}`);
    process.setuid(user);
    console.log(`User changed to: ${process.getuid()}`);

    console.log('Privileges dropped successfully');
  } catch (err) {
    console.error('Failed to drop privileges:', err.message);

    if (err.code === 'EPERM') {
      console.error('Permission denied. Ensure:');
      console.error('1. Process is running as root');
      console.error('2. setgid() is called before setuid()');
      console.error(`3. Group '${group}' exists on the system`);
    }

    process.exit(1);
  }
}

// Usage after binding to privileged port
dropPrivileges('www-data', 'www-data');