Repository navigation
Permission Model adoption from Package Managers #1300
Description
Hi folks,
As part of Permission Model initial roadmap (#898), we would like to discuss how Permission Model can be used by package managers to prevent (partially) supply chain attacks, mostly through postinstall scripts.
If you install a package containing a 'postinstall' script that attempts to compromise the filesystem somehow, the permission model can act and prevent it. Considering this is an experimental feature, I suggest having it behind a flag as well when using package managers.
cc: @nodejs/npm @arcanis
Activity
arcanis commentedon May 1, 2024
How would you envision it being used? Since legitimate postinstall scripts often are about building native packages, they end up executing code in a way that the Node permission model wouldn't apply.
RafaelGSS commentedon May 1, 2024
In case of building native packages, it will be denied, yeah. I was imagining a specific use case where a Node.js script is run. Do you see another use case for this? Either during the package installation or the module usage itself
arcanis commentedon May 2, 2024
On the top of my head I don't see a lot of use cases for Node.js-based postinstall scripts - afaik the two categories in the wild are:
optionalDependencies, since it integrates with the cache and lockfile. So we don't really want to encourage that.So limiting the scope of Node.js scripts during postinstall isn't that impactful imo: in most cases users will be better served by disabling the postinstall entirely (if it's an ad), or running it with full permissions (if it's a compiled package).
With that said I think it could be interesting to discuss how to make
yarn runsecure the processes it starts - while I'm afraid postinstall is kind of an unfortunate evil, I could imagine us setting up a jail inyarn runso that transitive dependencies of your scripts (especially those which don't define a postinstall scripts, and thus have less scrutiny) can't compromise the user.github-actions commentedon Aug 1, 2024
This issue has been inactive for 90 days. It will be closed in 14 days unless there is further activity or the stale label is taken off.