How to fix Error: setuid EPERM (operation not permitted, user change failed) in Node.js

// Correct: setgid first, then setuid
try {
  process.setgid('nobody');
  process.setuid('nobody');
  console.log('Successfully dropped privileges');
} catch (err) {
  console.error('Failed to drop privileges:', err.message);
  process.exit(1);
}

// Wrong: setuid first loses permission to call setgid
try {
  process.setuid('nobody'); // After this, you can't change group
  process.setgid('nobody'); // This will fail with EPERM
} catch (err) {
  console.error('Failed to drop privileges:', err.message);
}

# Start as root to allow privilege dropping
sudo node server.js

# Or with PM2
sudo pm2 start server.js

const http = require('http');

const server = http.createServer((req, res) => {
  res.writeHead(200);
  res.end('Hello World');
});

// Bind to privileged port 80 (requires root)
server.listen(80, () => {
  console.log('Server bound to port 80');

  // Drop privileges after binding
  try {
    process.setgid('nobody');
    process.setuid('nobody');
    console.log('Dropped privileges to nobody:nobody');
  } catch (err) {
    console.error('Could not drop privileges:', err.message);
    process.exit(1);
  }
});

# Grant CAP_SETUID and CAP_SETGID to node binary
sudo setcap cap_setuid,cap_setgid+ep $(which node)

# Verify capabilities
getcap $(which node)
# Output: /usr/bin/node = cap_setgid,cap_setuid+ep

// This will work even when started as a regular user
try {
  process.setgid('www-data');
  process.setuid('www-data');
  console.log('Privileges changed successfully');
} catch (err) {
  console.error('Failed:', err.message);
}

// Run on unprivileged port (>1024)
const server = http.createServer(handler);
server.listen(3000, () => {
  console.log('Server listening on port 3000');
  // No privilege dropping needed
});

# /etc/nginx/sites-available/myapp
server {
  listen 80;
  server_name example.com;

  location / {
    proxy_pass http://localhost:3000;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
  }
}

# Check if SELinux is enforcing
getenforce

# Check for denials
sudo ausearch -m avc -ts recent | grep setuid

# Check AppArmor status
sudo aa-status

# Check for denials
sudo dmesg | grep -i apparmor | grep -i denied