Node Permission Model: Lock Down Production Processes Running Plugins

// src/plugin-host.ts — spawn with an explicit allowlist
import { Worker } from "node:worker_threads";
import { fileURLToPath } from "node:url";

const PLUGIN_ROOT = fileURLToPath(new URL("../plugins/sandbox/", import.meta.url));

export function startPluginWorker(entry: string) {
 // ✅ Child gets permission flags; parent does not need them
 return new Worker(entry, {
 execArgv: [
 "--permission",
 `--allow-fs-read=${PLUGIN_ROOT}`,
 `--allow-fs-read=${process.execPath}`,
 `--allow-fs-write=${PLUGIN_ROOT}/tmp`,
 "--allow-net=api.partner.example.com",
 // omit --allow-child-process → denied
 ],
 workerData: { pluginRoot: PLUGIN_ROOT },
 });
}

// ❌ Same process, full FS — "we'll review plugins carefully"
import { createRequire } from "node:module";
const req = createRequire(import.meta.url);
export const plugin = req("./plugins/community/do-stuff.js");

// src/plugin-manifest.ts
export type PluginManifest = {
 id: string;
 fsRead: string[];
 fsWrite: string[];
 net: string[];
};

const ORG_DENY_NET = new Set(["169.254.169.254", "metadata.google.internal"]);

export function toExecArgv(m: PluginManifest, root: string): string[] {
 for (const p of [...m.fsRead, ...m.fsWrite]) {
 if (!p.startsWith(root)) throw new Error(`path_outside_root:${p}`);
 }
 for (const h of m.net) {
 if (ORG_DENY_NET.has(h) || h.includes("*")) throw new Error(`net_denied:${h}`);
 }
 return [
 "--permission",
 ...m.fsRead.map((p) => `--allow-fs-read=${p}`),
 ...m.fsWrite.map((p) => `--allow-fs-write=${p}`),
 ...m.net.map((h) => `--allow-net=${h}`),
 ];
}

// src/assert-permission.ts
export function assertPermissionModelEnabled() {
 if (typeof process.permission === "undefined") {
 throw new Error("NODE_PERMISSION_MODEL_REQUIRED");
 }
 const sneaky = "/etc/passwd";
 if (process.permission.has("fs.read", sneaky)) {
 throw new Error("over_permissioned_fs_read");
 }
}

# .github/workflows/plugin-host.yml
- name: Permission flag smoke
 run: |
 node --permission --allow-fs-read=$PWD/plugins/sandbox \
 --eval "require('./dist/assert-permission.js').assertPermissionModelEnabled()"

// src/plugin-worker-entry.ts
process.on("uncaughtException", (err: NodeJS.ErrnoException) => {
 if (err?.code === "ERR_ACCESS_DENIED") {
 metrics.increment("plugin.permission_denied", {
 plugin: process.env.PLUGIN_ID,
 });
 }
 throw err;
});