Commit 9e360df
doc: fix limitations and known issues in pm
PR-URL: #51184
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>1 parent f4d7f04 commit 9e360df
1 file changed
Lines changed: 16 additions & 12 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -564,26 +564,30 @@ be ignored. For example: `/home/*.js` will work similar to `/home/*`. | |||
| 564 | 564 | ||
| 565 | 565 | There are constraints you need to know before using this system: | |
| 566 | 566 | ||
| 567 | + * The model does not inherit to a child node process or a worker thread. | ||
| 568 | + * When using the Permission Model the following features will be restricted: | ||
| 569 | + * Native modules | ||
| 570 | + * Child process | ||
| 571 | + * Worker Threads | ||
| 572 | + * Inspector protocol | ||
| 573 | + * File system access | ||
| 574 | + * The Permission Model is initialized after the Node.js environment is set up. | ||
| 575 | + However, certain flags such as `--env-file` or `--openssl-config` are designed | ||
| 576 | + to read files before environment initialization. As a result, such flags are | ||
| 577 | + not subject to the rules of the Permission Model. | ||
| 578 | + * OpenSSL engines cannot be requested at runtime when the Permission | ||
| 579 | + Model is enabled, affecting the built-in crypto, https, and tls modules. | ||
| 580 | + | ||
| 581 | + #### Limitations and Known Issues | ||
| 582 | + | ||
| 567 | 583 | * When the permission model is enabled, Node.js may resolve some paths | |
| 568 | 584 | differently than when it is disabled. | |
| 569 | - * Native modules are restricted by default when using the Permission Model. | ||
| 570 | - * OpenSSL engines currently cannot be requested at runtime when the Permission | ||
| 571 | - Model is enabled, affecting the built-in crypto, https, and tls modules. | ||
| 572 | 585 | * Relative paths are not supported through the CLI (`--allow-fs-*`). | |
| 573 | - * The model does not inherit to a child node process. | ||
| 574 | - * The model does not inherit to a worker thread. | ||
| 575 | 586 | * Symbolic links will be followed even to locations outside of the set of paths | |
| 576 | 587 | that access has been granted to. Relative symbolic links may allow access to | |
| 577 | 588 | arbitrary files and directories. When starting applications with the | |
| 578 | 589 | permission model enabled, you must ensure that no paths to which access has | |
| 579 | 590 | been granted contain relative symbolic links. | |
| 580 | - * When creating symlinks the target (first argument) should have read and | ||
| 581 | - write access. | ||
| 582 | - * Permission changes are not retroactively applied to existing resources. | ||
| 583 | - * The Permission Model is initialized after the Node.js environment is set up. | ||
| 584 | - However, certain flags such as `--env-file` or `--openssl-config` are designed | ||
| 585 | - to read files before environment initialization. As a result, such flags are | ||
| 586 | - not subject to the rules of the Permission Model. | ||
| 587 | 591 | ||
| 588 | 592 | [Import maps]: https://url.spec.whatwg.org/#relative-url-with-fragment-string | |
| 589 | 593 | [Security Policy]: https://github.com/nodejs/node/blob/main/SECURITY.md | |
0 commit comments