Error "EPERM: operation not permitted, lstat ..." when deployed to full IIS with restricted permissions

[SteveSandersonMS]

In a typical IIS deployment, the application runs as a user that only has permission to read the filesystem at the level of the application and below. It does not usually have permission to read any attributes of ancestor-level directories.

This causes Node to throw an error when it tries to load any module. For example, if the module file was at C:\Users\username\apps\myapp1\, the IIS user would typically have access to read attributes of C:\ and C:\Users, but not C:\Users\username, so Node would throw:

Error: EPERM, operation not permitted 'C:\Users\username'
    at Error (native)
    at Object.bindingFs.lstat ([eval]:1:138)
    at Object.fs.lstatSync (fs.js:796:18)
    at Object.realpathSync (fs.js:1387:21)
    at tryFile (module.js:135:15)
    at Function.Module._findPath (module.js:174:18)
    at Function.Module._resolveFilename (module.js:334:25)
    at Function.Module._load (module.js:278:25)
    at Module.require (module.js:365:17)
    at require (module.js:384:17)

The underlying issue is a bug which was already reported to Node, i.e., that Node tries to walk along the file path to the module, starting from the disk root, reading the attributes of each directory to see whether or not it's a symlink. It's fine to do that in typical Linux/macOS cases, but is not at all fine in typical Windows cases.

This affects all uses of NodeServices (both the SPA templates, and any standalone usage) for applications deployed to IIS, such as those deployed to a local IIS instance by Visual Studio.

[SteveSandersonMS]

Fixed (or at least, temporarily worked around, until Node can really fix the underlying issue) in #1102

[theanimashaun]

Please, how do i get this fix ?

This issue has paused an app in production ? or is there a quick work around ?

[mvndaai]

I had this issue and was able to just use a try/catch to get around this for myself

fs.readdirSync(parentDir).forEach(file => {
    let fp = path.join(parentDir, file);
    let stat;
    try {
         stat = fs.statSync(fp);
    }catch (e){
        switch (e.code){
            case "EPERM":
                console.log("Did not have permission to check file/directory", fp);
                break;
            case "EBUSY":
                console.log("File is busy", fp);
                break;
            default:
                console.log(e);
        }
    }
    if (!stat) return;
    console.log(fp, stat.isDirectory());
});

[idenev]

@mvndaai Any suggestions where this code should be placed in the angular template? Thanks.

[mvndaai]

@idenev I am not exactly sure where you mean by the angular template, do you have an example. I would suggest making a function in your javascript that handles this and then just call it in angular.

[ganjeii]

I was able to get around this by performing an iisreset