Permissions scripting

オープン
  • 何か問題がありますか？
#67,130 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
35/100
issue の種類
機能追加
明瞭さ
おおむね明確
活発さ
活発
技術スタック
javascript, node.js
領域
security

調査の方向性

The issue does not name implementation files or tests. Start by reading Node.js's existing permission model and tracing how permission checks handle filesystem, child-process, and network access. The proposal needs design decisions about the script API, how it interacts with existing flags, and how checks are enforced; done means those behaviors are specified and covered by tests.

索引モデルが issue の本文から書いたものです。

説明

feature request
What is the problem this feature will solve?

Right now, permissions are either all-or-nothing, or each path must be manually specified.

There is also a lack of scoping on most permission flags. While adding scoping to these flags would help significantly, it would be helpful to be able to write custom logic to scope them in a more fine-grained fashion.

This feature request is primarily motivated by the lack of scoping on child. Initially I had drafted a feature request to add simple allow-listed scoping for child, but if, for instance, the python executable were to be allow-listed, a malicious script could run:

function portable_rm(file) {
  if (process.permission.has('fs.write', file) {
    // unlink file using node apis
  } else if (process.permission.has('child', 'rm') {
    // exec rm file
  } else if (process.permission.has('child', 'python') {
    // exec python -c 'import shutil; shutil.rmtree(...)'
  } // etc.
}

By using regex (or other custom logic), we can prevent these types of attacks by further limiting the command lines to known arguments.

What is the feature you are proposing to solve the problem?

A script that allows for custom scoping on all permission grants:

import path from 'node:path';

// Helper: path_str would already be an absolute path
function _check_path(path_str, allow_list) {
  for (const allowed_path of allow_list) {
    if (path.matchesGlob(path_str, path.resolve(allowed_path)))
      return true;
  }

  return false;
}

function check_fs_read(path_str) {
  return _check_path(path_str, [
    '/foo/*',
    './bar/baz.txt'
  ]);
}

function check_fs_write(path_str) {
  return _check_path(path_str, [
    './bar/baz.txt'
  ]);
}

function check_child(exec, args) {
  if (exec === "python") {
    if (args.length !== 2) return false;
    return args[0] === "myproc.py";
  } else if (exec === "esbuild") {
    if (args.length < 1) return false;
    return /^--(bundle|minify)$/.test(args[0]);
  }

  return false;
}

function check_net(addr) {
  return /^https:\/\/([^/]*\.)?mycompany\.com\//.test(addr);
}

export default {
  fs_read: check_fs_read,
  fs_write: check_fs_write,
  child: check_child,
  net: check_net,
  // any permission missing here would be denied by default, unless a respective --allow-* flag exists
}

It could then be run with (e.g.) node --permission --permissions-script=./permissions.js ...

The scoping does not necessarily have to be perfect, as just needs to match what the project knows it requires.

There would naturally be a minor performance hit, but this would allow for powerful scoping that would allow for projects to have permissions exactly as fine-grained as they needed.

On our end, the added security benefit far outweighs the performance hit, as it allows for better security during development. For deployment, we can replace the permission model with containers to remove the performance impact.

What alternatives have you considered?

  1. Using a socket-based permission broker: https://docs.deno.com/runtime/fundamentals/security/#permission-broker

  2. Adding regex-based allow-listing for child and net.

主要言語
JavaScript
スター
123k
フォーク
39.3k
平均マージ
4日 15時間
マージ済み PR（30日）
238

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

nodejs/node のほかの issue

nodejs/node の issue をすべて見る

似ている issue

JavaScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。