Permissions scripting

Aperta
  • Qualcosa non va?
#67,130 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
javascript, node.js
Ambito
security

Direzione di ricerca

The issue does not name implementation files or tests. Start by reading Node.js's existing permission model and tracing how permission checks handle filesystem, child-process, and network access. The proposal needs design decisions about the script API, how it interacts with existing flags, and how checks are enforced; done means those behaviors are specified and covered by tests.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

feature request
What is the problem this feature will solve?

Right now, permissions are either all-or-nothing, or each path must be manually specified.

There is also a lack of scoping on most permission flags. While adding scoping to these flags would help significantly, it would be helpful to be able to write custom logic to scope them in a more fine-grained fashion.

This feature request is primarily motivated by the lack of scoping on child. Initially I had drafted a feature request to add simple allow-listed scoping for child, but if, for instance, the python executable were to be allow-listed, a malicious script could run:

function portable_rm(file) {
  if (process.permission.has('fs.write', file) {
    // unlink file using node apis
  } else if (process.permission.has('child', 'rm') {
    // exec rm file
  } else if (process.permission.has('child', 'python') {
    // exec python -c 'import shutil; shutil.rmtree(...)'
  } // etc.
}

By using regex (or other custom logic), we can prevent these types of attacks by further limiting the command lines to known arguments.

What is the feature you are proposing to solve the problem?

A script that allows for custom scoping on all permission grants:

import path from 'node:path';

// Helper: path_str would already be an absolute path
function _check_path(path_str, allow_list) {
  for (const allowed_path of allow_list) {
    if (path.matchesGlob(path_str, path.resolve(allowed_path)))
      return true;
  }

  return false;
}

function check_fs_read(path_str) {
  return _check_path(path_str, [
    '/foo/*',
    './bar/baz.txt'
  ]);
}

function check_fs_write(path_str) {
  return _check_path(path_str, [
    './bar/baz.txt'
  ]);
}

function check_child(exec, args) {
  if (exec === "python") {
    if (args.length !== 2) return false;
    return args[0] === "myproc.py";
  } else if (exec === "esbuild") {
    if (args.length < 1) return false;
    return /^--(bundle|minify)$/.test(args[0]);
  }

  return false;
}

function check_net(addr) {
  return /^https:\/\/([^/]*\.)?mycompany\.com\//.test(addr);
}

export default {
  fs_read: check_fs_read,
  fs_write: check_fs_write,
  child: check_child,
  net: check_net,
  // any permission missing here would be denied by default, unless a respective --allow-* flag exists
}

It could then be run with (e.g.) node --permission --permissions-script=./permissions.js ...

The scoping does not necessarily have to be perfect, as just needs to match what the project knows it requires.

There would naturally be a minor performance hit, but this would allow for powerful scoping that would allow for projects to have permissions exactly as fine-grained as they needed.

On our end, the added security benefit far outweighs the performance hit, as it allows for better security during development. For deployment, we can replace the permission model with containers to remove the performance impact.

What alternatives have you considered?

  1. Using a socket-based permission broker: https://docs.deno.com/runtime/fundamentals/security/#permission-broker

  2. Adding regex-based allow-listing for child and net.

Lingua principale
JavaScript
Stelle
123k
Fork
39.3k
Merge medio
4g 16h
PR unite (30g)
227

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di nodejs/node

Tutte le issue di nodejs/node

Issue simili

Altre issue su JavaScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.