Terrible title but I will do my best to explain.
I have a simple robot that uses an Arduino Uno plugged into the USB. To interact with this as serial it requires me to run the application under sudo. I then take that command and create an interface to run it using NodeJS and Koa using exec sync...
export class Movement extends SubRoute {
constructor() {
super();
this.setRoute('get', '/forward', this.onForwardGet.bind(this));
}
async onForwardGet(ctx) {
try{
const stdOut = execSync("python3 /.../Code/pi-serial-example/robot/python/robot-hack/forward.py")
ctx.body = stdOut.toString('utf-8');
} catch(err){
// TODO: Remove error message
ctx.body = `There was an internal service error ${err}`;
ctx.response.status = 500;
}
}
}
// Another example using just Node...
const port = new SerialPort('/dev/ttyACM0', {
baudRate: 115200
});
port.on('readable', function () {
let record
while (record = port.read()) {
output.push(record.toString());
console.log(`The collection is \n ${JSON.stringify(output)}`);
}
})
port.on('error', function(err) {
console.log('Error: ', err.message);
});
port.on('close', function(){
console.log('The port is closed');
});
port.on('open', err =>{
console.log("The port is opened");
})
Now in order to run this I have to run the entire node application under sudo like...
sudo node --experimental-modules server.mjs
This seems like a security risk, it seems like I should be able to escalate individual requests instead of the entire app. What is the way to handle this more securely?
