GeezerVison

* WASI - manageable through [`--allow-wasi`][] flag

* Addons - manageable through [`--allow-addons`][] flag

Enable audit only for the permission model. When enabled, permission checks

are performed but access is not denied. Instead, a warning is emitted for

each permission violation via diagnostics channel.

* `--openssl-legacy-provider`

* `--openssl-shared-config`

* `--pending-deprecation`

* `--permission-audit`

* `--permission`

* `--preserve-symlinks-main`

* `--preserve-symlinks`

.It Fl -pending-deprecation

Emit pending deprecation warnings.

.It Fl -permission-audit

Enable audit only for the permission model. When enabled, permission checks

are performed but access is not denied. Instead, a warning is emitted for

each permission violation via diagnostics channel.

.It Fl -preserve-symlinks

Instructs the module loader to preserve symbolic links when resolving and caching modules other than the main module.

function initializePermission() {

const permission = getOptionValue('--permission');

const permission = getOptionValue('--permission') || getOptionValue('--permission-audit');

if (permission) {

process.binding = function binding(_module) {

throw new ERR_ACCESS_DENIED('process.binding');

tracing::CastTracedValue(traced_value));

}

if (options_->permission) {

if (options_->permission || options_->permission_audit) {

permission()->EnablePermissions();

if (options_->permission_audit) {

permission()->EnableWarningOnly();

}

// The process shouldn't be able to neither

// spawn/worker nor use addons or enable inspector

// unless explicitly allowed by the user

&EnvironmentOptions::permission,

kAllowedInEnvvar,

false);

AddOption("--permission-audit",

"enable audit only for the permission system",

&EnvironmentOptions::permission_audit,

kAllowedInEnvvar,

false);

AddOption("--allow-fs-read",

"allow permissions to read the filesystem",

&EnvironmentOptions::allow_fs_read,

std::string input_type; // Value of --input-type

bool entry_is_url = false;

bool permission = false;

bool permission_audit = false;

std::vector<std::string> allow_fs_read;

std::vector<std::string> allow_fs_write;

bool allow_addons = false;

#include "env-inl.h"

#include "memory_tracker-inl.h"

#include "node.h"

#include "node_diagnostics_channel.h"

#include "node_errors.h"

#include "node_external_reference.h"

#include "node_file.h"

namespace {

constexpr std::string_view GetDiagnosticsChannelName(PermissionScope scope) {

switch (scope) {

case PermissionScope::kFileSystem:

case PermissionScope::kFileSystemRead:

case PermissionScope::kFileSystemWrite:

return "node:permission-model:fs";

case PermissionScope::kChildProcess:

return "node:permission-model:child";

case PermissionScope::kWorkerThreads:

return "node:permission-model:worker";

case PermissionScope::kInspector:

return "node:permission-model:inspector";

case PermissionScope::kWASI:

return "node:permission-model:wasi";

case PermissionScope::kAddon:

return "node:permission-model:addon";

default:

return {};

}

}

static void Has(const FunctionCallbackInfo<Value>& args) {

}

#undef V

Permission::Permission() : enabled_(false) {

Permission::Permission() : enabled_(false), warning_only_(false) {

std::shared_ptr<PermissionBase> fs = std::make_shared<FSPermission>();

std::shared_ptr<PermissionBase> child_p =

std::make_shared<ChildProcessPermission>();

}

}

void Permission::EnableWarningOnly() {

if (!warning_only_) {

warning_only_ = true;

}

}

bool Permission::is_scope_granted(Environment* env,

const PermissionScope permission,

const std::string_view& res) const {

auto perm_node = nodes_.find(permission);

bool result = false;

if (perm_node != nodes_.end()) {

result = perm_node->second->is_granted(env, permission, res);

}

if (!result && !publishing_) {

auto channel_name = GetDiagnosticsChannelName(permission);

if (!channel_name.empty()) {

auto ch = GetOrCreateChannel(env, permission);

if (ch && ch->HasSubscribers()) {

publishing_ = true;

v8::Isolate* isolate = env->isolate();

v8::HandleScope handle_scope(isolate);

v8::Local<v8::Context> context = env->context();

v8::Local<v8::Object> msg =

v8::Object::New(isolate, v8::Null(isolate), nullptr, nullptr, 0);

const char* perm_str = PermissionToString(permission);

msg->Set(context,

FIXED_ONE_BYTE_STRING(isolate, "permission"),

v8::String::NewFromUtf8(isolate, perm_str).ToLocalChecked())

.Check();

msg->Set(context,

FIXED_ONE_BYTE_STRING(isolate, "resource"),

v8::String::NewFromUtf8(isolate,

res.data(),

v8::NewStringType::kNormal,

static_cast<int>(res.size()))

.ToLocalChecked())

.Check();

ch->Publish(env, msg);

publishing_ = false;

}

}

}

return result;

}

BaseObjectPtr<diagnostics_channel::Channel> Permission::GetOrCreateChannel(

Environment* env, PermissionScope scope) const {

auto it = channels_.find(scope);

if (it != channels_.end()) {

// Promote weak ref to strong for the duration of this call.

BaseObjectPtr<diagnostics_channel::Channel> ptr(it->second.get());

if (ptr) return ptr;

channels_.erase(it);

}

auto channel_name = GetDiagnosticsChannelName(scope);

diagnostics_channel::Channel* ch =

diagnostics_channel::Channel::Get(env, channel_name.data());

if (ch != nullptr) {

channels_.emplace(scope,

BaseObjectWeakPtr<diagnostics_channel::Channel>(ch));

return BaseObjectPtr<diagnostics_channel::Channel>(ch);

}

return {};

}

void Permission::Apply(Environment* env,

const std::vector<std::string>& allow,

PermissionScope scope) {

#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS

#include "debug_utils.h"

#include "node_diagnostics_channel.h"

#include "node_options.h"

#include "permission/addon_permission.h"

#include "permission/child_process_permission.h"

[[unlikely]] { \

node::permission::Permission::ThrowAccessDenied( \

env__, perm__, resource__); \

return __VA_ARGS__; \

if (!env__->permission()->warning_only()) return __VA_ARGS__; \

} \

} while (0)

[[unlikely]] { \

node::permission::Permission::AsyncThrowAccessDenied( \

env__, (wrap), perm__, resource__); \

return __VA_ARGS__; \

if (!env__->permission()->warning_only()) return __VA_ARGS__; \

} \

} while (0)

FORCE_INLINE bool enabled() const { return enabled_; }

FORCE_INLINE bool warning_only() const { return warning_only_; }

static PermissionScope StringToPermission(const std::string& perm);

static const char* PermissionToString(PermissionScope perm);

static void ThrowAccessDenied(Environment* env,

const std::vector<std::string>& allow,

PermissionScope scope);

void EnablePermissions();

void EnableWarningOnly();

private:

COLD_NOINLINE bool is_scope_granted(Environment* env,

const PermissionScope permission,

const std::string_view& res = "") const {

auto perm_node = nodes_.find(permission);

if (perm_node != nodes_.end()) {

return perm_node->second->is_granted(env, permission, res);

}

return false;

}

const std::string_view& res = "") const;

BaseObjectPtr<diagnostics_channel::Channel> GetOrCreateChannel(

Environment* env, PermissionScope scope) const;

std::unordered_map<PermissionScope, std::shared_ptr<PermissionBase>> nodes_;

bool enabled_;

bool warning_only_;

mutable bool publishing_ = false;

// Weak refs: BindingData (via BaseObjectPtr) is the sole owner of Channels.

// Using weak refs here avoids keeping Channels alive past Realm teardown.

mutable std::unordered_map<PermissionScope,

BaseObjectWeakPtr<diagnostics_channel::Channel>>

channels_;

};

} // namespace permission

const common = require('../common');

const { isMainThread } = require('worker_threads');

if (!isMainThread) {

common.skip('This test only works on a main thread');

const assert = require('node:assert');

const dc = require('node:diagnostics_channel');

const fs = require('node:fs');

const messages = [];

dc.subscribe('node:permission-model:fs', (msg) => {

messages.push(msg);

assert.strictEqual(messages.length, 0);

const hasWrite = process.permission.has('fs.write', '/tmp/test');

assert.strictEqual(hasWrite, false);

assert.ok(messages.length > 0, 'Expected at least one denied message');

assert.strictEqual(messages[0].permission, 'FileSystemWrite');