GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — lib,permission: add permission.drop · nodejs/node@cfb80a2

File tree

Expand file treeCollapse file tree
Open diff view settings
Filter options
  • doc/api
    • permissions.md
    • process.md
  • lib/internal/process
    • permission.js
    • pre_execution.js
  • src/permission
    • addon_permission.cc
    • addon_permission.h
    • child_process_permission.cc
    • child_process_permission.h
    • ffi_permission.cc
    • ffi_permission.h
    • fs_permission.cc
    • fs_permission.h
    • inspector_permission.cc
    • inspector_permission.h
    • net_permission.cc
    • net_permission.h
    • permission.cc
    • permission.h
    • permission_base.h
    • wasi_permission.cc
    • wasi_permission.h
    • worker_permission.cc
    • worker_permission.h
  • test/parallel
    • test-permission-drop-child-process.js
    • test-permission-drop-diagnostics-channel.js
    • test-permission-drop-errors.js
    • test-permission-drop-ffi.js
    • test-permission-drop-fs-all.js
    • test-permission-drop-fs-granted-path.js
    • test-permission-drop-fs-read.js
    • test-permission-drop-fs-scope.js
    • test-permission-drop-fs-specific-path.js
    • test-permission-drop-fs-write.js
    • test-permission-drop-net.js
    • test-permission-drop-not-enabled.js
    • test-permission-drop-worker.js
Expand file treeCollapse file tree
Open diff view settings
Collapse file

‎doc/api/permissions.md‎

Copy file name to clipboardExpand all lines: doc/api/permissions.md
+36-1Lines changed: 36 additions & 1 deletion
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ flag. For WASI, use the [`--allow-wasi`][] flag. For FFI, use the
7878

7979
When enabling the Permission Model through the [`--permission`][]
8080
flag a new property `permission` is added to the `process` object.
81-
This property contains one function:
81+
This property contains the following functions:
8282

8383
##### `permission.has(scope[, reference])`
8484

@@ -92,6 +92,41 @@ process.permission.has('fs.read'); // true
9292
process.permission.has('fs.read', '/home/rafaelgss/protected-folder'); // false
9393
```
9494

95+
##### `permission.drop(scope[, reference])`
96+
97+
API call to drop permissions at runtime. This operation is **irreversible**.
98+
99+
When called without a reference, the entire scope is dropped. When called
100+
with a reference, only the permission for that specific resource is revoked.
101+
Dropping a permission only affects future access checks. It does not close or
102+
revoke access to resources that are already open, such as file descriptors,
103+
network sockets, child processes, or worker threads. Applications are
104+
responsible for closing or terminating those resources when they are no longer
105+
needed.
106+
107+
You can only drop the exact resource that was explicitly granted. The
108+
reference passed to `drop()` must match the original grant. If a permission
109+
was granted using a wildcard (`*`), only the entire scope can be dropped
110+
(by calling `drop()` without a reference). If a directory was granted
111+
(e.g. `--allow-fs-read=/my/folder`), you cannot drop individual files
112+
inside it - you must drop the same directory that was originally granted.
113+
114+
```js
115+
const fs = require('node:fs');
116+
117+
// Read config at startup while we still have permission
118+
const config = fs.readFileSync('/etc/myapp/config.json', 'utf8');
119+
120+
// Drop read access to /etc/myapp after initialization
121+
process.permission.drop('fs.read', '/etc/myapp');
122+
123+
// This will now throw ERR_ACCESS_DENIED
124+
process.permission.has('fs.read', '/etc/myapp/config.json'); // false
125+
126+
// Drop child process permission entirely
127+
process.permission.drop('child');
128+
```
129+
95130
#### File System Permissions
96131

97132
The Permission Model, by default, restricts access to the file system through the `node:fs` module.
Collapse file

‎doc/api/process.md‎

Copy file name to clipboardExpand all lines: doc/api/process.md
+60Lines changed: 60 additions & 0 deletions
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -3167,6 +3167,65 @@ process.permission.has('fs.read', './README.md');
31673167
process.permission.has('fs.read');
31683168
```
31693169
3170+
### `process.permission.drop(scope[, reference])`
3171+
3172+
<!-- YAML
3173+
added: REPLACEME
3174+
-->
3175+
3176+
> Stability: 1.1 - Active Development
3177+
3178+
* `scope` {string}
3179+
* `reference` {string}
3180+
3181+
Drops the specified permission from the current process. This operation is
3182+
**irreversible** — once a permission is dropped, it cannot be restored through
3183+
any Node.js API.
3184+
3185+
If no reference is provided, the entire scope is dropped. For example,
3186+
`process.permission.drop('fs.read')` will revoke ALL file system read
3187+
permissions.
3188+
3189+
When a reference is provided, only the permission for that specific resource
3190+
is dropped. For example, `process.permission.drop('fs.read', '/etc/myapp')`
3191+
will revoke read access to that directory while keeping other read
3192+
permissions intact.
3193+
3194+
**Important:** You can only drop the exact resource that was explicitly
3195+
granted. The reference passed to `drop()` must match the original grant:
3196+
3197+
* If a permission was granted using a wildcard (`*`), such as
3198+
`--allow-fs-read=*`, individual paths cannot be dropped - only the entire
3199+
scope can be dropped (by calling `drop()` without a reference).
3200+
* If a directory was granted (e.g. `--allow-fs-read=/my/folder`), you cannot
3201+
drop access to individual files inside it. You must drop the same directory
3202+
that was granted. Any remaining grants continue to apply.
3203+
3204+
The available scopes are the same as [`process.permission.has()`][]:
3205+
3206+
* `fs` - All File System (drops both read and write)
3207+
* `fs.read` - File System read operations
3208+
* `fs.write` - File System write operations
3209+
* `child` - Child process spawning operations
3210+
* `worker` - Worker thread spawning operation
3211+
* `net` - Network operations
3212+
* `inspector` - Inspector operations
3213+
* `wasi` - WASI operations
3214+
* `addon` - Native addon operations
3215+
3216+
```js
3217+
const fs = require('node:fs');
3218+
3219+
// Read configuration during startup
3220+
const config = fs.readFileSync('/etc/myapp/config.json', 'utf8');
3221+
3222+
// Drop read access to the config directory after initialization
3223+
process.permission.drop('fs.read', '/etc/myapp');
3224+
3225+
// This will now throw ERR_ACCESS_DENIED
3226+
fs.readFileSync('/etc/myapp/config.json');
3227+
```
3228+
31703229
## `process.pid`
31713230
31723231
<!-- YAML
@@ -4583,6 +4642,7 @@ cases:
45834642
[`process.hrtime()`]: #processhrtimetime
45844643
[`process.hrtime.bigint()`]: #processhrtimebigint
45854644
[`process.kill()`]: #processkillpid-signal
4645+
[`process.permission.has()`]: #processpermissionhasscope-reference
45864646
[`process.setUncaughtExceptionCaptureCallback()`]: #processsetuncaughtexceptioncapturecallbackfn
45874647
[`promise.catch()`]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise/catch
45884648
[`queueMicrotask()`]: globals.md#queuemicrotaskcallback
Collapse file

‎lib/internal/process/permission.js‎

Copy file name to clipboardExpand all lines: lib/internal/process/permission.js
+12Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,18 @@ module.exports = ObjectFreeze({
4343

4444
return permission.has(scope, reference);
4545
},
46+
drop(scope, reference) {
47+
validateString(scope, 'scope');
48+
if (reference != null) {
49+
if (isBuffer(reference)) {
50+
validateBuffer(reference, 'reference');
51+
} else {
52+
validateString(reference, 'reference');
53+
}
54+
}
55+
56+
permission.drop(scope, reference);
57+
},
4658
availableFlags() {
4759
if (_ffi === undefined) {
4860
const { getOptionValue } = require('internal/options');
Collapse file

‎lib/internal/process/pre_execution.js‎

Copy file name to clipboardExpand all lines: lib/internal/process/pre_execution.js
+2-1Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -660,7 +660,7 @@ function initializePermission() {
660660
};
661661
// Guarantee path module isn't monkey-patched to bypass permission model
662662
ObjectFreeze(require('path'));
663-
const { has } = require('internal/process/permission');
663+
const { has, drop } = require('internal/process/permission');
664664
const warnFlags = [
665665
'--allow-addons',
666666
'--allow-child-process',
@@ -712,6 +712,7 @@ function initializePermission() {
712712
configurable: false,
713713
value: {
714714
has,
715+
drop,
715716
},
716717
});
717718
} else {
Collapse file

‎src/permission/addon_permission.cc‎

Copy file name to clipboardExpand all lines: src/permission/addon_permission.cc
+6Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,12 @@ void AddonPermission::Apply(Environment* env,
1414
deny_all_ = true;
1515
}
1616

17+
void AddonPermission::Drop(Environment* env,
18+
PermissionScope scope,
19+
const std::string_view& param) {
20+
deny_all_ = true;
21+
}
22+
1723
bool AddonPermission::is_granted(Environment* env,
1824
PermissionScope perm,
1925
const std::string_view& param) const {
Collapse file

‎src/permission/addon_permission.h‎

Copy file name to clipboardExpand all lines: src/permission/addon_permission.h
+3Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ class AddonPermission final : public PermissionBase {
1515
void Apply(Environment* env,
1616
const std::vector<std::string>& allow,
1717
PermissionScope scope) override;
18+
void Drop(Environment* env,
19+
PermissionScope scope,
20+
const std::string_view& param = "") override;
1821
bool is_granted(Environment* env,
1922
PermissionScope perm,
2023
const std::string_view& param = "") const override;
Collapse file

‎src/permission/child_process_permission.cc‎

Copy file name to clipboardExpand all lines: src/permission/child_process_permission.cc
+6Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,12 @@ void ChildProcessPermission::Apply(Environment* env,
1515
deny_all_ = true;
1616
}
1717

18+
void ChildProcessPermission::Drop(Environment* env,
19+
PermissionScope scope,
20+
const std::string_view& param) {
21+
deny_all_ = true;
22+
}
23+
1824
bool ChildProcessPermission::is_granted(Environment* env,
1925
PermissionScope perm,
2026
const std::string_view& param) const {
Collapse file

‎src/permission/child_process_permission.h‎

Copy file name to clipboardExpand all lines: src/permission/child_process_permission.h
+3Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ class ChildProcessPermission final : public PermissionBase {
1515
void Apply(Environment* env,
1616
const std::vector<std::string>& allow,
1717
PermissionScope scope) override;
18+
void Drop(Environment* env,
19+
PermissionScope scope,
20+
const std::string_view& param = "") override;
1821
bool is_granted(Environment* env,
1922
PermissionScope perm,
2023
const std::string_view& param = "") const override;
Collapse file

‎src/permission/ffi_permission.cc‎

Copy file name to clipboardExpand all lines: src/permission/ffi_permission.cc
+6Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,12 @@ void FFIPermission::Apply(Environment* env,
1414
deny_all_ = true;
1515
}
1616

17+
void FFIPermission::Drop(Environment* env,
18+
PermissionScope scope,
19+
const std::string_view& param) {
20+
deny_all_ = true;
21+
}
22+
1723
bool FFIPermission::is_granted(Environment* env,
1824
PermissionScope perm,
1925
const std::string_view& param) const {
Collapse file

‎src/permission/ffi_permission.h‎

Copy file name to clipboardExpand all lines: src/permission/ffi_permission.h
+3Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ class FFIPermission final : public PermissionBase {
1515
void Apply(Environment* env,
1616
const std::vector<std::string>& allow,
1717
PermissionScope scope) override;
18+
void Drop(Environment* env,
19+
PermissionScope scope,
20+
const std::string_view& param = "") override;
1821
bool is_granted(Environment* env,
1922
PermissionScope perm,
2023
const std::string_view& param = "") const override;

0 commit comments

Comments
0 (0)
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.