lib: handle --permission-audit when propagating flags - #63047
Merged
nodejs-github-bot merged 2 commits intoMay 6, 2026
Merged
Conversation
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
Collaborator
|
Review requested:
|
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #63047 +/- ##
==========================================
+ Coverage 89.63% 89.65% +0.01%
==========================================
Files 708 708
Lines 220402 220423 +21
Branches 42271 42270 -1
==========================================
+ Hits 197551 197610 +59
+ Misses 14706 14662 -44
- Partials 8145 8151 +6
🚀 New features to boost your workflow:
|
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
Collaborator
jasnell
approved these changes
May 6, 2026
Collaborator
|
Landed in dc99d18 |
aduh95
pushed a commit
that referenced
this pull request
May 19, 2026
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #63047 Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: James M Snell <jasnell@gmail.com>
aduh95
pushed a commit
that referenced
this pull request
May 19, 2026
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #63047 Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: James M Snell <jasnell@gmail.com>
This was referenced Aug 30, 2026
theSnackOverflow
added a commit
to theSnackOverflow/node
that referenced
this pull request
Aug 30, 2026
--permission-audit is documented to perform permission checks without denying access, publishing each violation through the diagnostics channel while execution continues. Three code paths still enforced: * fs.lstat() and fs.symlink() are checked in the JavaScript layer, which threw ERR_ACCESS_DENIED without consulting audit mode. The isAuditMode() helper introduced for ffi was never wired into fs. * Addon loading was disabled upfront in Environment setup, so process.dlopen() failed with ERR_DLOPEN_DISABLED before reaching the audit-aware permission check, and no audit event was published. Skip the throw in the JavaScript checks when audit mode is on, keeping the permission.has() call first so the diagnostics channel event is still published. Leave native addons enabled in audit mode while still applying the kAddon scope, so DLOpen() publishes the denial through the channel and continues to the regular loading path. This also covers the worker path, which inherits kNoNativeAddons from the same option. Each fs API carries its own copy of the check in its sync, callback and promise flavour, so the regression test exercises all six call sites, asserting the --permission enforce behaviour as a control. Fixes: nodejs#65419 Refs: nodejs#63047 Assisted-by: claude:opus-5 Signed-off-by: Ji Hoon Kang <ivory.ma9ic@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
As titled.
I have also included
--permission-auditin the check of FFI permissions.