CODEWITHSUNDEEP
node.jsnpmnpm-install
xpt
xpt

Reputation: 23006

npm sudo global installation & unsafe-perm

I am trying to install a npm module with: 

sudo npm install -g now

However, when I try that, I get a warning:

Warning! Please try installing Now CLI again with the --unsafe-perm option.
Example: npm i -g --unsafe-perm now

This unsafe permission worries me, and I want to make it clear whether I need to follow it to fix the warning, or I can ignore it?

The explanation at https://docs.npmjs.com/misc/config#unsafe-perm doesn't really tell much, for me. This commented from sam-github on Mar 30, 2016 explains much more clearly about the implication.

However, even after reading the two several times, I'm still unclear what --unsafe-perm is doing, and what's the implication. So,

  • Default: false if running as root
  • Set to true to suppress the UID/GID switching when running package scripts.

Is the above two "running" telling about the same thing or different things? If it the same thing, then is it the install time or run time?

All I want is to be able to

so what should I do?

Upvotes: 24

Views: 68396

Answers (1)

antzshrek
antzshrek

Reputation: 9933

As you rightly read from unsafe-perm

  • Default: false if running as root, true otherwise
  • Type: Boolean

Set to true to suppress the UID/GID switching when running package scripts. If set explicitly to false, then installing as a non-root user will fail.

To answer your first question:

All I want is to be able to install it, follow the steps below.

If you’re going to use sudo to install now, you need to specify the --unsafe-perm option to run npm as the root account. And you can as well do that directly from your terminal by running

sudo npm install --unsafe-perm=true -g now

To answer your next question:

All I want is to be able to let anyone in my system able to use it, with the least security risk

I will advice you run your installation of now on root mood so that any user can use it and won't have the permission of uninstalling it by any means without the root permission. So maybe you should disregard the regular practice

Upvotes: 11

Related Questions