Error "EPERM: operation not permitted, lstat ..." when deployed to full IIS with restricted permissions

In a typical IIS deployment, the application runs as a user that only has permission to read the filesystem at the level of the application and below. It does not usually have permission to read any attributes of ancestor-level directories.

This causes Node to throw an error when it tries to load any module. For example, if the module file was at C:\Users\username\apps\myapp1\, the IIS user would typically have access to read attributes of C:\ and C:\Users, but not C:\Users\username, so Node would throw:

Error: EPERM, operation not permitted 'C:\Users\username'
    at Error (native)
    at Object.bindingFs.lstat ([eval]:1:138)
    at Object.fs.lstatSync (fs.js:796:18)
    at Object.realpathSync (fs.js:1387:21)
    at tryFile (module.js:135:15)
    at Function.Module._findPath (module.js:174:18)
    at Function.Module._resolveFilename (module.js:334:25)
    at Function.Module._load (module.js:278:25)
    at Module.require (module.js:365:17)
    at require (module.js:384:17)

The underlying issue is a bug which was already reported to Node, i.e., that Node tries to walk along the file path to the module, starting from the disk root, reading the attributes of each directory to see whether or not it's a symlink. It's fine to do that in typical Linux/macOS cases, but is not at all fine in typical Windows cases.

This affects all uses of NodeServices (both the SPA templates, and any standalone usage) for applications deployed to IIS, such as those deployed to a local IIS instance by Visual Studio.

On Windows, patch Node's lstat to work around permissions error. Fixes …

Fixed (or at least, temporarily worked around, until Node can really fix the underlying issue) in #1102

Complete the lstat patching for #1101

Merge pull request #1111 from aspnet/rel/2.0.0

Please, how do i get this fix ?

This issue has paused an app in production ? or is there a quick work around ?

I had this issue and was able to just use a try/catch to get around this for myself

fs.readdirSync(parentDir).forEach(file => {
    let fp = path.join(parentDir, file);
    let stat;
    try {
         stat = fs.statSync(fp);
    }catch (e){
        switch (e.code){
            case "EPERM":
                console.log("Did not have permission to check file/directory", fp);
                break;
            case "EBUSY":
                console.log("File is busy", fp);
                break;
            default:
                console.log(e);
        }
    }
    if (!stat) return;
    console.log(fp, stat.isDirectory());
});

@mvndaai

@mvndaai Any suggestions where this code should be placed in the angular template? Thanks.

@idenev

@idenev I am not exactly sure where you mean by the angular template, do you have an example. I would suggest making a function in your javascript that handles this and then just call it in angular.

I was able to get around this by performing an iisreset

Navigation Menu

Repository navigation

Error "EPERM: operation not permitted, lstat ..." when deployed to full IIS with restricted permissions #1101

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Error "EPERM: operation not permitted, lstat ..." when deployed to full IIS with restricted permissions #1101

Description

Activity

SteveSandersonMS commented on Jul 11, 2017

theanimashaun commented on Jul 18, 2017

mvndaai commented on Sep 26, 2017

idenev commented on Oct 6, 2017

mvndaai commented on Oct 9, 2017

ganjeii commented on Jan 23, 2018

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions