process: initial impl of feature access control #22112
+925
−3
Next
Next commit
process: initial impl of feature access control
Implement `process.accessControl`, a simple API for restricting usage of certain in-process APIs. Refs: https://github.com/nodejs/node/issues/22107
commit 85373119c0757634d237733f85b5d51ee384b8bb
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -36,6 +36,7 @@ | ||
| #include "node.h" | ||
| #include "node_http2_state.h" | ||
|
|
||
| #include <bitset> | ||
| #include <list> | ||
| #include <stdint.h> | ||
| #include <vector> | ||
| @@ -235,6 +236,7 @@ struct PackageConfig { | ||
| V(password_string, "password") \ | ||
| V(path_string, "path") \ | ||
| V(pending_handle_string, "pendingHandle") \ | ||
| V(permission_string, "permission") \ | ||
| V(pid_string, "pid") \ | ||
| V(pipe_string, "pipe") \ | ||
| V(pipe_target_string, "pipeTarget") \ | ||
| @@ -418,6 +420,59 @@ enum class DebugCategory { | ||
| CATEGORY_COUNT | ||
| }; | ||
|
|
||
| class AccessControl { | ||
| public: | ||
| enum Permission { | ||
|
There was a problem hiding this comment. any reason this is defined as an There was a problem hiding this comment. @gioragutt Nothing, besides the fact that it creates an extra scope inside what is already a scope, so accessing it means a bit more stuff to write out. (One could move it one layer up into the There was a problem hiding this comment. Okay, I guess that since this is not the global scope, this is fine. |
||
| #define ACCESS_CONTROL_FLAGS(V) \ | ||
| V(accessInspectorBindings) \ | ||
| V(childProcesses) \ | ||
| V(createWorkers) \ | ||
| V(fsRead) \ | ||
| V(fsWrite) \ | ||
| V(loadAddons) \ | ||
| V(modifyTraceEvents) \ | ||
| V(netConnectionless) \ | ||
| V(netIncoming) \ | ||
| V(netOutgoing) \ | ||
| V(setEnvironmentVariables) \ | ||
| V(setProcessAttrs) \ | ||
| V(setV8Flags) \ | ||
| V(signalProcesses) \ | ||
|
|
||
| #define V(kind) kind, | ||
| ACCESS_CONTROL_FLAGS(V) | ||
| #undef V | ||
| kNumPermissions | ||
| }; | ||
|
|
||
| inline AccessControl(); | ||
|
|
||
| inline void set_permission(Permission perm, bool value); | ||
| inline bool has_permission(Permission perm) const; | ||
| inline void apply(const AccessControl& other); | ||
|
|
||
| static Permission PermissionFromString(const char* str); | ||
| static const char* PermissionToString(Permission perm); | ||
|
|
||
| v8::MaybeLocal<v8::Object> ToObject(v8::Local<v8::Context> context); | ||
| static v8::Maybe<AccessControl> FromObject(v8::Local<v8::Context> context, | ||
| v8::Local<v8::Object> object); | ||
|
|
||
| static void ThrowAccessDenied(Environment* env, Permission perm); | ||
|
|
||
| private: | ||
| std::bitset<kNumPermissions> permissions_; | ||
| }; | ||
|
|
||
| #define THROW_IF_INSUFFICIENT_PERMISSIONS(env, perm_, ...) \ | ||
| do { \ | ||
| const AccessControl::Permission perm = (AccessControl::Permission::perm_); \ | ||
| if (UNLIKELY(!(env)->access_control()->has_permission(perm))) { \ | ||
| AccessControl::ThrowAccessDenied((env), perm); \ | ||
| return __VA_ARGS__; \ | ||
| } \ | ||
| } while (0) | ||
|
|
||
| class Environment { | ||
| public: | ||
| class AsyncHooks { | ||
| @@ -627,6 +682,7 @@ class Environment { | ||
| inline void IncreaseWaitingRequestCounter(); | ||
| inline void DecreaseWaitingRequestCounter(); | ||
|
|
||
| inline AccessControl* access_control(); | ||
| inline AsyncHooks* async_hooks(); | ||
| inline ImmediateInfo* immediate_info(); | ||
| inline TickInfo* tick_info(); | ||
| @@ -897,6 +953,7 @@ class Environment { | ||
| uv_check_t idle_check_handle_; | ||
| bool profiler_idle_notifier_started_ = false; | ||
|
|
||
| AccessControl access_control_; | ||
| AsyncHooks async_hooks_; | ||
| ImmediateInfo immediate_info_; | ||
| TickInfo tick_info_; | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,123 @@ | ||
| #include "node_internals.h" | ||
| #include "node_errors.h" | ||
| #include "env-inl.h" | ||
|
|
||
| using v8::Boolean; | ||
| using v8::Context; | ||
| using v8::EscapableHandleScope; | ||
| using v8::FunctionCallbackInfo; | ||
| using v8::HandleScope; | ||
| using v8::Isolate; | ||
| using v8::Just; | ||
| using v8::Local; | ||
| using v8::Maybe; | ||
| using v8::MaybeLocal; | ||
| using v8::Nothing; | ||
| using v8::Object; | ||
| using v8::Value; | ||
|
|
||
| namespace node { | ||
|
|
||
| MaybeLocal<Object> AccessControl::ToObject(Local<Context> context) { | ||
| Isolate* isolate = context->GetIsolate(); | ||
| EscapableHandleScope handle_scope(isolate); | ||
|
|
||
| Local<Object> obj = Object::New(isolate); | ||
|
|
||
| #define V(kind) \ | ||
| if (obj->Set(context, \ | ||
| FIXED_ONE_BYTE_STRING(isolate, #kind), \ | ||
| Boolean::New(isolate, has_permission(kind))).IsNothing()) { \ | ||
| return MaybeLocal<Object>(); \ | ||
| } | ||
| ACCESS_CONTROL_FLAGS(V) | ||
| #undef V | ||
|
|
||
| return handle_scope.Escape(obj); | ||
| } | ||
|
|
||
| Maybe<AccessControl> AccessControl::FromObject(Local<Context> context, | ||
| Local<Object> obj) { | ||
| Isolate* isolate = context->GetIsolate(); | ||
| HandleScope scope(isolate); | ||
|
|
||
| AccessControl ret; | ||
|
|
||
| Local<Value> field; | ||
| #define V(kind) \ | ||
| if (!obj->Get(context, FIXED_ONE_BYTE_STRING(isolate, #kind)) \ | ||
| .ToLocal(&field)) { \ | ||
| return Nothing<AccessControl>(); \ | ||
| } \ | ||
| ret.set_permission(kind, !field->IsFalse()); | ||
| ACCESS_CONTROL_FLAGS(V) | ||
| #undef V | ||
|
|
||
| return Just(ret); | ||
| } | ||
|
|
||
| AccessControl::Permission AccessControl::PermissionFromString(const char* str) { | ||
| #define V(kind) if (strcmp(str, #kind) == 0) return kind; | ||
| ACCESS_CONTROL_FLAGS(V) | ||
| #undef V | ||
| return kNumPermissions; | ||
| } | ||
|
|
||
| const char* AccessControl::PermissionToString(Permission perm) { | ||
| switch (perm) { | ||
| #define V(kind) case kind: return #kind; | ||
| ACCESS_CONTROL_FLAGS(V) | ||
| #undef V | ||
| default: return nullptr; | ||
| } | ||
| } | ||
|
|
||
| void AccessControl::ThrowAccessDenied(Environment* env, Permission perm) { | ||
| Local<Value> err = ERR_ACCESS_DENIED(env->isolate()); | ||
| CHECK(err->IsObject()); | ||
| err.As<Object>()->Set( | ||
| env->context(), | ||
| env->permission_string(), | ||
| v8::String::NewFromUtf8(env->isolate(), | ||
| PermissionToString(perm), | ||
| v8::NewStringType::kNormal).ToLocalChecked()) | ||
| .FromMaybe(false); // Nothing to do about an error at this point. | ||
| env->isolate()->ThrowException(err); | ||
| } | ||
|
|
||
| namespace ac { | ||
|
|
||
| void Apply(const FunctionCallbackInfo<Value>& args) { | ||
| Environment* env = Environment::GetCurrent(args); | ||
|
|
||
| AccessControl access_control; | ||
| Local<Object> obj; | ||
| if (!args[0]->ToObject(env->context()).ToLocal(&obj) || | ||
| !AccessControl::FromObject(env->context(), obj).To(&access_control)) { | ||
| return; | ||
| } | ||
|
|
||
| env->access_control()->apply(access_control); | ||
| } | ||
|
|
||
| void GetCurrent(const FunctionCallbackInfo<Value>& args) { | ||
| Environment* env = Environment::GetCurrent(args); | ||
|
|
||
| Local<Object> ret; | ||
| if (env->access_control()->ToObject(env->context()).ToLocal(&ret)) | ||
| args.GetReturnValue().Set(ret); | ||
| } | ||
|
|
||
| void Initialize(Local<Object> target, | ||
| Local<Value> unused, | ||
| Local<Context> context, | ||
| void* priv) { | ||
| Environment* env = Environment::GetCurrent(context); | ||
| env->SetMethod(target, "apply", Apply); | ||
| env->SetMethod(target, "getCurrent", GetCurrent); | ||
| } | ||
|
|
||
| } // namespace ac | ||
| } // namespace node | ||
|
|
||
| NODE_MODULE_CONTEXT_AWARE_INTERNAL(access_control, node::ac::Initialize) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,159 @@ | ||
| 'use strict'; | ||
| const common = require('../common'); | ||
| const tmpdir = require('../common/tmpdir'); | ||
| const assert = require('assert'); | ||
| const path = require('path'); | ||
| const fs = require('fs'); | ||
| const net = require('net'); | ||
|
|
||
| tmpdir.refresh(); | ||
|
|
||
| assert.deepStrictEqual(process.accessControl.getCurrent(), { | ||
| accessInspectorBindings: true, | ||
| childProcesses: true, | ||
| createWorkers: true, | ||
| fsRead: true, | ||
| fsWrite: true, | ||
| loadAddons: true, | ||
| modifyTraceEvents: true, | ||
| netConnectionless: true, | ||
| netIncoming: true, | ||
| netOutgoing: true, | ||
| setEnvironmentVariables: true, | ||
| setProcessAttrs: true, | ||
| setV8Flags: true, | ||
| signalProcesses: true | ||
| }); | ||
|
|
||
| { | ||
| process.accessControl.apply({ setEnvironmentVariables: false }); | ||
|
|
||
| assert.strictEqual(process.env.CANT_SET_ME, undefined); | ||
|
|
||
| common.expectsError(() => { process.env.CANT_SET_ME = 'bar'; }, { | ||
| type: Error, | ||
| message: 'Access to this API has been restricted', | ||
| code: 'ERR_ACCESS_DENIED' | ||
| }); | ||
|
|
||
| assert.strictEqual(process.env.CANT_SET_ME, undefined); | ||
|
|
||
| assert.strictEqual(process.accessControl.getCurrent().setEnvironmentVariables, | ||
| false); | ||
|
|
||
| // Setting any other permission to 'false' will also disable child processes | ||
| // or loading addons. | ||
| assert.strictEqual(process.accessControl.getCurrent().childProcesses, | ||
| false); | ||
| assert.strictEqual(process.accessControl.getCurrent().loadAddons, | ||
| false); | ||
|
|
||
| // Setting values previously set to 'false' back to 'true' should not work. | ||
| process.accessControl.apply({ setEnvironmentVariables: true }); | ||
| assert.strictEqual(process.accessControl.getCurrent().setEnvironmentVariables, | ||
| false); | ||
|
|
||
| process.accessControl.apply({ childProcesses: true }); | ||
| assert.strictEqual(process.accessControl.getCurrent().childProcesses, | ||
| false); | ||
| } | ||
|
|
||
| if (common.isMainThread) { | ||
| process.accessControl.apply({ setProcessAttrs: false }); | ||
|
|
||
| common.expectsError(() => { process.title = 'doesntwork'; }, { | ||
| type: Error, | ||
| message: 'Access to this API has been restricted', | ||
| code: 'ERR_ACCESS_DENIED' | ||
| }); | ||
| } | ||
|
|
||
| { | ||
| // Spin up echo server. | ||
| const server = net.createServer((sock) => sock.pipe(sock)) | ||
| .listen(0, common.mustCall(() => { | ||
| const existingSocket = net.connect(server.address().port, '127.0.0.1'); | ||
| existingSocket.once('connect', common.mustCall(() => { | ||
| process.accessControl.apply({ netOutgoing: false }); | ||
|
|
||
| existingSocket.write('foo'); | ||
| existingSocket.setEncoding('utf8'); | ||
| existingSocket.once('data', common.mustCall((data) => { | ||
| assert.strictEqual(data, 'foo'); | ||
| existingSocket.end(); | ||
| server.close(); | ||
| })); | ||
|
|
||
| net.connect(server.address().port, '127.0.0.1') | ||
| .once('error', common.expectsError({ | ||
| type: Error, | ||
| message: /connect EPERM 127\.0\.0\.1:\d+/, | ||
| code: 'EPERM' | ||
| })); | ||
| })); | ||
| })); | ||
| } | ||
|
|
||
| { | ||
| process.accessControl.apply({ netIncoming: false }); | ||
|
|
||
| net.createServer().listen(0).once('error', common.expectsError({ | ||
| type: Error, | ||
| message: /listen EPERM 0\.0\.0\.0/, | ||
| code: 'EPERM' | ||
| })); | ||
| } | ||
|
|
||
| { | ||
| const writeStream = fs.createWriteStream( | ||
| path.join(tmpdir.path, 'writable-stream.txt')); | ||
|
|
||
| process.accessControl.apply({ fsWrite: false }); | ||
|
|
||
| common.expectsError(() => { fs.writeFileSync('foo.txt', 'blah'); }, { | ||
| type: Error, | ||
| message: 'Access to this API has been restricted', | ||
| code: 'ERR_ACCESS_DENIED' | ||
| }); | ||
|
|
||
| // The 'open' event is emitted because permissions were still available | ||
| // originally, but... | ||
| writeStream.on('open', common.mustCall(() => { | ||
| // ... actually writing data is forbidden. | ||
| common.expectsError(() => { writeStream.write('X'); }, { | ||
| type: Error, | ||
| message: 'Access to this API has been restricted', | ||
| code: 'ERR_ACCESS_DENIED' | ||
| }); | ||
| })); | ||
| } | ||
|
|
||
| { | ||
| const readStream = fs.createReadStream(__filename); | ||
|
|
||
| // The fs module kicks off reading automatically by calling .read(). | ||
| // We want to intercept the exception, so we have to wrap .read(): | ||
| readStream.read = common.mustCall(() => { | ||
| common.expectsError(() => { | ||
| fs.ReadStream.prototype.read.call(readStream); | ||
| }, { | ||
| type: Error, | ||
| message: 'Access to this API has been restricted', | ||
| code: 'ERR_ACCESS_DENIED' | ||
| }); | ||
| }); | ||
|
|
||
| process.accessControl.apply({ fsRead: false }); | ||
|
|
||
| common.expectsError(() => { fs.readFileSync('foo.txt'); }, { | ||
| type: Error, | ||
| message: 'Access to this API has been restricted', | ||
| code: 'ERR_ACCESS_DENIED' | ||
| }); | ||
|
|
||
| common.expectsError(() => { require('nonexistent.js'); }, { | ||
| type: Error, | ||
| message: 'Access to this API has been restricted', | ||
| code: 'ERR_ACCESS_DENIED' | ||
| }); | ||
| } |
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This should be clarified. For instance, if I use
fs.createWriteStream()now to open a file for writing, then set the access control policy, will I be able to use the write stream or no?Another question: if the Node.js process stdout/stderr are redirected to a pipe and fsWrite is denied, what happens when the process attempts to write out?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@jasnell This is a very good point.
You will not, because of the way fs streams are implemented – as individual
fs.readandfs.writeoperations in JS.However, existing network sockets can still be used, because we implement them in a very abstract way in C++ that is not specific to the kind of resource (e.g.
net&ttyall use the same code). We can align behaviours if we think that that makes sense, though.I’ve pushed docs & test changes to account for these scenarios.
Assuming you meant “redirected to a file”: An exception occurs.
console.logand friends silence those, but using rawprocess.stdout.write()will throw.