https://github.com/ab/raise-if-root

Raise hell if your app is run as root
https://github.com/ab/raise-if-root

Last synced: about 2 months ago
JSON representation

Raise hell if your app is run as root

• Host: GitHub
• URL: https://github.com/ab/raise-if-root
• Owner: ab
• License: gpl-3.0
• Created: 2017-08-28T14:11:04.000Z (over 7 years ago)
• Default Branch: master
• Last Pushed: 2019-08-21T04:40:34.000Z (over 5 years ago)
• Last Synced: 2024-04-26T14:03:33.996Z (9 months ago)
• Language: Ruby
• Size: 21.5 KB
• Stars: 3
• Watchers: 2
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • Changelog: CHANGELOG.md
  • License: LICENSE.txt

Awesome Lists containing this project

README

        
# Raise If Root

[![Gem Version](https://badge.fury.io/rb/raise-if-root.svg)](https://rubygems.org/gems/raise-if-root)

[![Build status](https://travis-ci.org/ab/raise-if-root.svg)](https://travis-ci.org/ab/raise-if-root)

[![Code Climate](https://codeclimate.com/github/ab/raise-if-root.svg)](https://codeclimate.com/github/ab/raise-if-root)

[![Inline Docs](http://inch-ci.org/github/ab/raise-if-root.svg?branch=master)](http://www.rubydoc.info/github/ab/raise-if-root/master)

*Raise If Root* is a small gem that helps prevent your application from ever

running as the root user (uid 0).

## Why?

Many software systems rely on user privilege separation for security reasons.

Especially within containers or chroots, running as a non-privileged user gives

stronger isolation.

*Raise If Root* helps enforce that you never inadvertently load your

application code as root.

Will it protect you if your attacker is already running as root? Probably not.

But it does help remove opportunities for error, where you might accidentally

run root rake tasks, cron jobs, or deploy scripts.

## Usage

Add the gem to your application's Gemfile:

```ruby

gem 'raise-if-root', '~> 0'

```

Require it from your main application code:

```ruby

require 'raise-if-root'

```

There is no step three! This will raise `RaiseIfRoot::AssertionFailed` if the

current uid is 0.

### More complex patterns

See the [YARD documentation](http://www.rubydoc.info/github/ab/raise-if-root/master).

If you want to enforce that the application is running as a particular user,

there are several more specific functions available.

Load the library, which doesn't immediately raise when you load it.

```ruby

# load the library, which doesn't raise

require 'raise-if-root/library'

# raise if running as uid 1000

RaiseIfRoot.raise_if_uid(1000)

# raise unless user is nobody

RaiseIfRoot.raise_if(username_not: 'nobody')

# raise with multiple conditions

RaiseIfRoot.raise_if(uid_not: 1000, gid_not: 500)

```

### Notification callbacks

If you want to sound the alarm with something more than just the exception, you

can add callbacks to send emails, smoke signals, etc.

```ruby

# load the library, which doesn't raise

require 'raise-if-root/library'

RaiseIfRoot.add_assertion_callback do |err|

  Mail.deliver do

    from    '[email protected]'

    to      '[email protected]'

    subject 'App was run as root'

    body    "RaiseIfRoot is raising an exception:\n  #{err.inspect}\n"

  end

end

# ensure we're not root

RaiseIfRoot.raise_if_root

```

## Contributing

1. Fork it

2. Create your feature branch (`git checkout -b my-new-feature`)

3. Commit your changes (`git commit -am 'Add some feature'`)

4. Push to the branch (`git push origin my-new-feature`)

5. Create new Pull Request