pm2 cli should probably talk with a daemon over a unix socket, not tcp. This will solve permissions problems as well.

@rlidwka you are right, so far I had just been using pm2 as a (happy) user, I hadn't looked at the code when I described this issue.

And, of course, since pm2 has a client-side and a server-side, this security issue is more complicated to solve than just the proposed solution above. Unix socket is surely a part of the solution, but will it be enough? I will look at how PostgreSQL and its psql cli do it.

Cheers,

This is a very serious issue for anyone having more than one user on a server. What is the solution? Why would even pm2 allow any other user to access pm2 started as a different user?

Isn't this linked to the npm global install somehow ?

#329 does not fix this

I still have an issue related to this. I'm listening on a socket. The daemon is started as root and i'm using --run-as-user to start nodejs apps.

But the socket doesn't get created. Of course, it's working if i'm starting the daemon as my own user name but we are in a multiuser environment.

#487

#642

I still have this issue with version 0.10.1 (from npm or https://github.com/Unitech/PM2.git at this moment) : any local user can stop all apps handled by pm2 but then couldn't start these apps.

Yes we're aware of this but it has been moved to #642 or how things would be resolved (1.0).