Weird permission requests

[KaKi87]

Hi,

I'm encountering weird permission requests when running my main.js without -A :

⚠️  Deno requests env access to "NODE_V8_COVERAGE".
⚠️  Deno requests env access to "V8_COVERAGE".
⚠️  Deno requests sys access to "hostname".
⚠️  Deno requests read access to <main_module>.
⚠️  Deno requests read access to "/home/kaki/.cache/deno/node_modules".

Why ?

Thanksd

[bartlomieju]

There's nothing weird about it, you are using npm:commander package, it's that package that requests these permissions.

[KaKi87]

Well, I thought so, but then I looked for NODE_V8_COVERAGE at tj/commander.js, which returns nothing, same for the other environment variable ;

Also I can't figure out what sys access to "hostname" and read access to <main_module> mean ;

Finally, Deno requests read access to "/home/kaki/.cache/deno/node_modules" is plain weird, like as if import statements required permissions, which doesn't sound right, but if I reject anyway then the script still works, and if I try --allow-read="/home/kaki/.cache/deno/node_modules" then it still prompts for it...

[bartlomieju]

Try executing just this line: import createFastify from 'npm:fastify@^4';

deno run main.js
✅ Granted env access to "NODE_V8_COVERAGE".
✅ Granted env access to "V8_COVERAGE".
✅ Granted sys access to "hostname".

These three are getting asked by fastify (or its dependencies).

The <main_module> permissions is queried if you use Deno.mainModule or process.argv.

Finally, Deno requests read access to "/home/kaki/.cache/deno/node_modules" is plain weird, like as if import statements required permissions, which doesn't sound right, but if I reject anyway then the script still works, and if I try --allow-read="/home/kaki/.cache/deno/node_modules" then it still prompts for it...

No, these permissions are only asked by require() calls - because they accept any JS expression they can't be statically analyzed and we need to query for permissions there. Most likely the require() call is wrapped in try {} catch {} and that's why the program still works. Some libraries do that to try and load a certain library (eg. v8-code-cache or source-maps).

Hope that helps.

[0f-0b]

fastify uses pino for logging. pino includes the hostname in the log messages. pino also accesses the V8_COVERAGE environment variables to work around an issue in older versions of Node.js.

commander reads process.argv[1] in advance in case it needs to infer the program name or to search for standalone executable subcommands. Since you don't use either feature, you can prevent commander from doing this by changing the last line of main.js to the following.

program.parse(Deno.args, { from: 'user' });

// or if you don't want to use a Deno-specific API
import process from 'node:process';
program.parse(process.argv.slice(2), { from: 'user' });

[KaKi87]

Wow, thank you two very much for such a thorough analysis !

No, these permissions are only asked by require() calls

Okay, how do I get those granted though ? Initially I tried --allow-read="~/.cache/deno/node_modules" without success, then I tried --allow-read="$HOME/.cache/deno/node_modules" still without success, so I put the exact path --allow-read="/home/kaki/.cache/deno/node_modules" but even that didn't work :/

fastify uses pino for logging. pino includes the hostname in the log messages. pino also accesses the V8_COVERAGE environment variables to work around an issue in older versions of Node.js.

I see, but the logger is also disabled by default 🤔