Node.js permission model: --permission, --allow-fs-read va uning chegaralari

Qisqacha: node --permission app.js jarayonga fayl tizimi, bola jarayonlar (child process), worker'lar va native addon'larni sukut bo'yicha taqiqlaydi. Kerakli joyni o'zingiz ochasiz: --allow-fs-read=<papka>/*, --allow-fs-write=…, --allow-child-process. Ruxsatsiz urinish — ERR_ACCESS_DENIED. Lekin bu "xavfsizlik kamari", qamoqxona emas: hujjatning o'zi zararli kodga qarshi kafolat bermasligini aytadi. Eng muhim chegarasi — kanonda topilgan: Node 24 da tarmoq cheklanmaydi (--allow-net → bad option), muhit o'zgaruvchilari ham ochiq.

Bu darsda

• --permission ni yoqib, qaysi amal qanday xato bilan to'xtashini haqiqiy chiqish bilan ko'rasiz.
• --allow-fs-read, --allow-fs-write, --allow-child-process bilan faqat kerakli ruxsatni berasiz.
• process.permission.has va drop bilan dastur ichidan ruxsatni tekshirasiz va qaytarib berasiz.
• --permission-audit bilan "nima kerak bo'ladi?" ro'yxatini yig'asiz.
• Permission model nimani cheklamasligini (tarmoq, env, simvolik havolalar) aniq ayta olasiz.

Oldin bilishingiz kerak: Ta'minot zanjiri xavfsizligi, fs: uch API shakli, child_process, Built-in fetch va undici.

1. Nega bu kerak?

valyuta 0 ta prod bog'liqlik bilan yozilgan. Lekin ko'p loyihada yuzlab paket bor (ta'minot zanjiri darsi). Ulardan biri buzilsa-chi? Masalan, kurs formatlaydigan kichik paketning yangi versiyasi ~/.ssh papkasini o'qib, biror serverga yuborsa.

Oddiy node da har kod hamma narsaga qodir: istalgan faylni o'qiydi, yozadi, boshqa dastur ishga tushiradi. Permission model (ruxsatlar modeli) — Node'ga "bu dasturga faqat shu papkani o'qish mumkin" deyish usuli. Telefoningizdagi ilova ruxsatlari kabi: kalkulyatorga kamera ruxsati kerak emas.

O'xshatish: mehmonxona kalit-kartasi. Karta faqat sizning xonangiz va nonushta zalini ochadi. Lekin karta yo'lakdagi telefonni o'chirmaydi — siz baribir istalgan joyga qo'ng'iroq qila olasiz. Node 24 dagi permission model ham shunday: fayllar yopiq, tarmoq esa ochiq.

2. --permission: hammasi yopiq

2.1 Birinchi sinov

Avval holati haqida bir gap. Hujjatga ko'ra permission model 23.5.0 va 22.13.0 dan beri barqaror (Stable). Node 24.0.0 da bayroq nomi ham qisqardi: --experimental-permission o'rniga endi --permission. Eski maqolalarda uzun nomni ko'rsangiz — gap shu haqida.

Kichik loyiha yasadik: loyiha/app.mjs o'z data/kurs.json faylini o'qiydi, qo'shni sir/kalit.txt ni o'qishga urinadi, data/ ga yozadi, bola jarayon ishga tushiradi va process.env.SIR_TOKEN ni o'qiydi. Har amal try/catch ichida, xatoning code, permission va resource maydonlari chiqariladi:

import { readFile, writeFile } from "node:fs/promises";
import { execFileSync } from "node:child_process";
import { fileURLToPath } from "node:url";

const attempt = async (name, fn) => {
  try {
    console.log(name, "→", String(await fn()).trim());
  } catch (e) {
    const where = e.resource ?? "";
    console.log(name, "→", e.code, e.permission ?? "", where);
  }
};
const here = (p) => new URL(p, import.meta.url);
const read = (p) => () => readFile(here(p), "utf8");
await attempt("data o'qish", read("./data/kurs.json"));
await attempt("sir o'qish", read("../sir/kalit.txt"));
await attempt("data yozish", () =>
  writeFile(here("./data/yangi.json"), "{}"));
await attempt("child_process", () =>
  execFileSync(process.execPath, ["-v"], { encoding: "utf8" }));
await attempt("env", () => process.env.SIR_TOKEN);

const p = process.permission; // --permission siz — undefined
const data = fileURLToPath(here("./data/kurs.json"));
console.log("has fs.read data:", p?.has("fs.read", data));
console.log("has fs.write:", p?.has("fs.write"),
  "| child:", p?.has("child"), "| net:", p?.has("net"));

Bu blok --permission bayrog'i bilan ishlashi kerak — zavod tekshiruvchisi bunday bayroqni bera olmaydi, shuning uchun nocheck. Biz ishga tushirdik (Node 24.21.0, Windows 11):

SIR_TOKEN=abc node --permission loyiha/app.mjs

Har qatorda strelkadan (→) keyingi so'zga qarang. Bitta qator boshqalardan farq qiladi:

data o'qish → ERR_ACCESS_DENIED FileSystemRead \\?\C:\Users\…\loyiha\data\kurs.json
sir o'qish → ERR_ACCESS_DENIED FileSystemRead \\?\C:\Users\…\sir\kalit.txt
data yozish → ERR_ACCESS_DENIED FileSystemWrite \\?\C:\Users\…\loyiha\data\yangi.json
child_process → ERR_ACCESS_DENIED ChildProcess C:\Users\…\node.exe
env → abc
has fs.read data: false
has fs.write: false | child: false | net: false

Qatorma-qator:

• Har fayl amali — ERR_ACCESS_DENIED ("kirish rad etildi"), permission maydonida turi: FileSystemRead yoki FileSystemWrite. resource — aynan qaysi fayl. \\?\ — Windows'ning uzun yo'l prefiksi, Node yo'lni shunday saqlaydi.
• Bola jarayon — ChildProcess turi bilan rad etildi.
• Oxirgi ikki qator — process.permission.has javoblari (pastda batafsil).
• env → abc — muhit o'zgaruvchisi bemalol o'qildi. Permission model process.env ga tegmaydi. .env dagi tokenlaringiz zararli kod uchun ham ochiq.

2.2 Kirish fayli o'qiladi, importlar — yo'q

Qiziq joy: app.mjs ning o'zi ishga tushdi, garchi o'qish ruxsati bo'lmasa ham. Node kirish faylini o'zi ochadi. Lekin u boshqa faylni import qilsa:

node --permission loyiha/imp.mjs

Error: Access to this API has been restricted. Use --allow-fs-read to manage permissions.
  code: 'ERR_ACCESS_DENIED',
  permission: 'FileSystemRead',
  resource: '\\\\?\\C:\\Users\\…\\loyiha\\k.mjs'

"Bu API'ga kirish cheklangan. Ruxsatlarni --allow-fs-read bilan boshqaring". imp.mjs dagi import "./k.mjs" ham fayl o'qish. Shuning uchun haqiqiy loyihada (valyuta ning 19 ta moduli) loyiha papkasini o'qish ruxsati birinchi navbatda kerak. Kanon ham shuni ko'rdi: node --permission dist/bin.js kurs USD — darhol FileSystemRead, exit 1.

flowchart LR
  N["node --permission"] --> E["kirish fayli<br/>(ruxsatsiz ochiladi)"]
  E -->|import| M["boshqa modullar"]
  E -->|readFile / writeFile| F["fayllar"]
  E -->|spawn| C["child process"]
  E -->|fetch| T["tarmoq"]
  M -.- R1["--allow-fs-read"]
  F -.- R2["--allow-fs-read / write"]
  C -.- R3["--allow-child-process"]
  T -.- R4["cheklanmaydi"]

O'ngdagi uzuq chiziqlar — har yo'lni qaysi bayroq ochadi. Eng pastki — tarmoq: Node 24 da u uchun bayroq yo'q.

Tekshirib ko'ring: node --permission server.mjs darhol ERR_ACCESS_DENIED … FileSystemRead … routes.mjs bilan yiqildi. Serveringiz hali hech qanday fayl o'qimagan. Nega?

3. Ruxsat berish

3.1 Faqat kerakli papka

data/ ni o'qishga ruxsat berdik (Windows'da to'liq yo'l bilan):

SIR_TOKEN=abc node --permission \
  --allow-fs-read="C:\Users\…\loyiha\data\*" loyiha/app.mjs

data o'qish → {"USD":11903.15}
sir o'qish → ERR_ACCESS_DENIED FileSystemRead \\?\C:\Users\…\sir\kalit.txt
data yozish → ERR_ACCESS_DENIED FileSystemWrite \\?\C:\Users\…\loyiha\data\yangi.json
child_process → ERR_ACCESS_DENIED ChildProcess C:\Users\…\node.exe
env → abc
has fs.read data: true
has fs.write: false | child: false | net: false

Aynan kerakli narsa: data/ o'qildi, qo'shni sir/ — yo'q. O'qish ruxsati yozishni bermaydi. Oxiridagi * — "shu papka ichidagi hamma narsa".

Bayroqlar ro'yxati (Node 24 hujjati):

3.2 --allow-child-process — ehtiyot bo'ling

Hamma narsani ochib ko'rdik:

SIR_TOKEN=abc node --permission --allow-fs-read=* \
  --allow-fs-write="…\data\*" --allow-child-process loyiha/app.mjs

(node:14032) [PERM0002] SecurityWarning: The flag --allow-child-process must be used with extreme caution. It could invalidate the permission model.
(Use `node --trace-warnings ...` to show where the warning was created)
data o'qish → {"USD":11903.15}
sir o'qish → maxfiy-kalit
data yozish → undefined
child_process → v24.21.0
env → abc
has fs.read data: true
has fs.write: false | child: true | net: false

Birinchi qator — Node'ning o'z ogohlantirishi: "--allow-child-process ni juda ehtiyotkorlik bilan ishlating — u ruxsatlar modelini bekor qilishi mumkin". Sababi oddiy: bola jarayon — yangi dastur. U --permission siz ishga tushishi va hamma faylni o'qishi mumkin. Bola jarayonga ruxsat berish — kalit-kartani butun binoga berish bilan teng.

(node:14032) — jarayon raqami (PID), sizda boshqa. data yozish → undefined — writeFile muvaffaqiyatli tugadi (qiymat qaytarmaydi).

3.3 Ichkaridan tekshirish: process.permission

Dastur o'z ruxsatlarini bilishi mumkin. process.permission faqat --permission bilan bor (aks holda undefined):

has fs.read data: true
has fs.write: false | child: false | net: false

Bu — «Faqat kerakli papka» bo'limidagi ishga tushirishning oxirgi ikki qatori. has("fs.read", yo'l) — aniq faylga; has("fs.write") yo'lsiz — "hamma joyga yozish ruxsati bormi" (yo'q).

net: false — ehtiyot bo'ling! has("net") false qaytaradi, lekin tarmoq ishlaydi (keyingi bo'lim). Bu qiymatga tayanib "tarmoq yopiq" deb xulosa qilmang.

Ruxsatni dastur ichida qaytarib berish ham mumkin — process.permission.drop. Masalan, sozlamani o'qib bo'lgach, o'qish ruxsatidan voz kechish:

import { readFileSync } from "node:fs";

const here = (p) => new URL(p, import.meta.url);
const config = readFileSync(here("./sir/kalit.txt"), "utf8");
console.log("sozlama o'qildi:", config.trim().length, "belgi");
process.permission.drop("fs.read");
console.log("fs.read:", process.permission.has("fs.read"));
try {
  readFileSync(here("./sir/kalit.txt"));
} catch (e) {
  console.log(e.code, e.permission);
}

node --permission --allow-fs-read=* drop.mjs

sozlama o'qildi: 12 belgi
fs.read: false
ERR_ACCESS_DENIED FileSystemRead

drop qaytarib bo'lmaydi: bir marta voz kechilgan ruxsat jarayon oxirigacha yopiq. Hujjatga ko'ra u faqat keyingi tekshiruvlarga ta'sir qiladi — oldin ochilgan fayl deskriptorlari ishlayveradi.

4. Kanon topilmasi: tarmoq ochiq

valyuta ni permission model bilan ishga tushirdik (kanon t44). Faqat loyiha papkasini o'qish ruxsati:

$ node --permission --allow-fs-read=<valyuta>/* dist/bin.js kurs USD
Xato: Access to this API has been restricted. Use --allow-fs-read to manage permissions.
[exit 1]

Kod yuklandi, lekin kesh papkasini o'qib bo'lmadi. E'tibor bering: valyuta bu xatoni yashirmadi. Kesh ENOENT (fayl yo'q) bo'lsa — "kesh yo'q" deb davom etadi, boshqa xatoni esa yuqoriga uzatadi (xavfsiz fayl operatsiyalari qoidasi). Bu yerda to'g'ri xulq: ruxsat yo'qligini foydalanuvchi ko'rishi kerak.

Kesh papkasiga o'qish va yozish ruxsati qo'shildi:

$ ... --allow-fs-read=<kesh>/* --allow-fs-write=<kesh>/*
2026-10-23 holatiga (api)
USD    1    11 903.15   -62.36  AQSH dollari
[exit 0]

Ishladi — va (api): kurs haqiqiy CBU'dan, internet orqali keldi. Hech qanday tarmoq ruxsati berilmagan edi. --allow-net ni sinab ko'rdik:

…\node.exe: bad option: --allow-net
[exit 9]

"Noto'g'ri bayroq" — Node 24.21 da bunday bayroq yo'q. Hujjatdagi cheklanadigan ro'yxatda ham tarmoq yo'q: fayl tizimi, child process, worker, WASI, addon'lar, OpenSSL loader'lar.

Xulosa: Node 24 da permission model zararli paketning fayllaringizni o'qishini to'xtatadi. Lekin agar u allaqachon qo'lidagi narsani (masalan process.env dagi tokenni) internetga yuborsa — to'xtatmaydi.

5. Chegaralar: "xavfsizlik kamari"

Hujjat o'zi shunday deydi (qisqa tarjima): permission model — "seat belt" (xavfsizlik kamari) yondashuvi; u ishonchli kodni tasodifan ruxsatsiz joyga tegishdan saqlaydi, lekin zararli kod bo'lsa xavfsizlik kafolatini bermaydi.

Oxirgi qator alohida muhim. Zararli paketlarning ko'pchiligi postinstall skriptida ishlaydi — npm install paytida, sizning dasturingiz ishga tushishidan oldin. Unga qarshi boshqa vositalar: npm 11 ning o'rnatish skriptlarini bloklashi (TS to'g'ridan darsida esbuild misolida ko'rdik), npm ci --ignore-scripts, lock fayl va kod tekshiruvi.

Tekshirib ko'ring: Hamkasbingiz: "Biz node --permission --allow-fs-read=./app/* bilan ishga tushiramiz, endi buzilgan paket hech narsa o'g'irlay olmaydi". Qayerda xato?

6. --permission-audit: avval kuzating

Qaysi ruxsatlar kerakligini qanday bilasiz? Taxmin bilan --allow-fs-read yozib, har xatoda bittadan qo'shish — sekin. Audit rejimi tekshiradi, lekin rad etmaydi. Bu bayroq yangi — hujjatga ko'ra 24.20.0 da qo'shilgan, eski Node 24 versiyalarida yo'q. Har buzilish node:diagnostics_channel kanaliga yoziladi:

import diagnostics_channel from "node:diagnostics_channel";
import { readFileSync } from "node:fs";

const fsChannel =
  diagnostics_channel.channel("node:permission-model:fs");
fsChannel.subscribe((m) => {
  console.log(`audit: ${m.permission} ${m.resource}`);
});
const here = new URL("./sir/kalit.txt", import.meta.url);
console.log(readFileSync(here, "utf8").trim());

node --permission-audit audit.mjs

audit: FileSystemRead \\?\C:\Users\…\sir\kalit.txt
maxfiy-kalit

Fayl o'qildi (maxfiy-kalit), lekin oldin audit xabari chiqdi. Obunachisiz audit jim ishlaydi — biz sinab ko'rdik, hech narsa chiqmadi. Kanallar: node:permission-model:fs, …:child, …:worker, …:inspector, …:wasi, …:addon.

Ish tartibi: dasturni audit bilan odatdagi ish ssenariylarida yurgizing → ro'yxatni yig'ing → shu asosda --allow-* bayroqlarini yozing → --permission bilan ishga tushiring.

7. CLI qadami: valyuta va permission model

Yangi holat yo'q — kanon permission model'ni package.json ga kiritmadi. Sabablari:

• valyuta — foydalanuvchi o'z kompyuterida ishga tushiradigan CLI. Kesh papkasi OS'ga qarab har xil (%LOCALAPPDATA%, ~/.cache, $XDG_CACHE_HOME — path va os darsi). Yo'llarni har OS uchun bayroqqa yozish skriptni murakkablashtiradi.
• Prod bog'liqlik 0 — himoya qilinadigan "begona kod" yo'q.
• Asosiy xavf (tarmoq) Node 24 da baribir cheklanmaydi.

Lekin model qayerda foydali — kanon tajribasi ko'rsatdi: kesh ENOENT bo'lmagan xatoni yutib yubormasligi to'g'ri ekan. O'quvchi npx @login/valyuta ni ishonchsiz deb hisoblasa, o'zi shunday ishga tushirishi mumkin (Windows, PowerShell):

node --permission --allow-fs-read="<valyuta papkasi>\*" `
  --allow-fs-read="$env:LOCALAPPDATA\valyuta\*" `
  --allow-fs-write="$env:LOCALAPPDATA\valyuta\*" `
  <valyuta papkasi>\dist\bin.js kurs USD

Bu — namuna; biz kanonda aynan VALYUTA_KESH va VALYUTA_SOZLAMA ni bitta vaqtinchalik papkaga yo'naltirib sinadik. Linux va macOS'da sinalmagan.

8. Ko'p uchraydigan xatolar

9. Mashqlar

Yechimlar kurs/mashqlar/24/44-permission/ da.

1-mashq (oson): ruxsat bormi?

node --permission --allow-fs-read=/app/* bilan:

• /app/config.json ni o'qish —
• /app/log.txt ga yozish —
• fetch("https://example.com") —
• process.env.TOKEN ni o'qish —
• spawn("git", ["status"]) —

2-mashq (o'rta): ruxsat xatosini tushunarli qilish

ERR_ACCESS_DENIED xatosini foydalanuvchi tushunadigan matnga aylantiradigan explainAccess(error) funksiyasini yozing. permission FileSystemRead bo'lsa — Ruxsat yo'q: <resource> ni o'qish (--allow-fs-read); FileSystemWrite — … yozish (--allow-fs-write); ChildProcess — Ruxsat yo'q: dastur ishga tushirish (--allow-child-process). Boshqa xatolar o'zgarishsiz message bilan qaytsin. Yo'ldagi \\?\ prefiksini olib tashlang. Bu toza JS — soxta xato obyektlari bilan sinang.

const ACTIONS = {
  FileSystemRead: ["o'qish", "--allow-fs-read"],
  FileSystemWrite: ["yozish", "--allow-fs-write"],
};

function explainAccess(error) {
  if (error.code !== "ERR_ACCESS_DENIED") return error.message;
  if (error.permission === "ChildProcess") {
    const flag = "--allow-child-process";
    return `Ruxsat yo'q: dastur ishga tushirish (${flag})`;
  }
  const action = ACTIONS[error.permission] ?? ["ishlatish", "?"];
  const [what, flag] = action;
  const path = String(error.resource ?? "").replace(/^\\\\\?\\/, "");
  return `Ruxsat yo'q: ${path} ni ${what} (${flag})`;
}

const denied = (permission, resource) =>
  Object.assign(new Error("Access to this API has been restricted"), {
    code: "ERR_ACCESS_DENIED",
    permission,
    resource,
  });

const winPath = "\\\\?\\C:\\kesh\\a.json";
console.log(explainAccess(denied("FileSystemRead", winPath)));
console.log(explainAccess(denied("FileSystemWrite", "/tmp/x")));
console.log(explainAccess(denied("ChildProcess", "git")));
console.log(explainAccess(new Error("ENOENT: no such file")));

Ruxsat yo'q: C:\kesh\a.json ni o'qish (--allow-fs-read)
Ruxsat yo'q: /tmp/x ni yozish (--allow-fs-write)
Ruxsat yo'q: dastur ishga tushirish (--allow-child-process)
ENOENT: no such file

3-mashq (qiyin): audit jurnalidan bayroqlar

Audit rejimi xabarlari massivi berilgan: { permission, resource }. Undan --allow-* bayroqlari ro'yxatini yasang: o'qish va yozish yo'llarini papka bo'yicha guruhlang (<papka>/*), takrorlarni olib tashlang, alifbo tartibida chiqaring; ChildProcess bo'lsa — bitta --allow-child-process. Yo'llar / bilan (soddalik uchun POSIX).

const FLAG = {
  FileSystemRead: "--allow-fs-read",
  FileSystemWrite: "--allow-fs-write",
};

function flagsFromAudit(events) {
  const flags = new Set();
  for (const { permission, resource } of events) {
    if (permission === "ChildProcess") {
      flags.add("--allow-child-process");
      continue;
    }
    const dir = resource.slice(0, resource.lastIndexOf("/"));
    flags.add(`${FLAG[permission]}=${dir}/*`);
  }
  return [...flags].sort();
}

const cache = "/home/ali/.cache/v/k.json";
const events = [
  { permission: "FileSystemRead", resource: "/app/dist/cli.js" },
  { permission: "FileSystemRead", resource: "/app/dist/kurs.js" },
  { permission: "FileSystemRead", resource: cache },
  { permission: "FileSystemWrite", resource: cache },
  { permission: "ChildProcess", resource: "git" },
];
console.log(flagsFromAudit(events).join("\n"));

--allow-child-process
--allow-fs-read=/app/dist/*
--allow-fs-read=/home/ali/.cache/v/*
--allow-fs-write=/home/ali/.cache/v/*

10. Real ishda

• Ishonchsiz skript yoki plagin ishga tushirishda — masalan, foydalanuvchi yozgan qoida fayllari, npx bilan bir martalik vosita: --permission bilan faqat kerakli papka.
• Serverlarda tarmoq va jarayonni cheklash odatda OS va konteyner darajasida qilinadi (Docker — 26-qism): alohida foydalanuvchi, faqat o'qiladigan fayl tizimi, firewall. Node'ning modeli — qo'shimcha qatlam.
• Deno bilan taqqoslash: u boshidan "hammasi yopiq" va tarmoq ham (--allow-net) cheklanadi. Node bu yo'lga keyinroq chiqqan, tarmoq qismi hali yo'q.
• Intervyu savoli: "Node'da buzilgan npm paketidan qanday himoyalanasiz?" — lock fayl, npm audit, install skriptlarini bloklash, permission model va uning chegaralari.

Xulosa

• --permission fayl tizimi, child process, worker, addon, WASI va inspector'ni yopadi; kirish faylidan boshqa har modul import'i ham o'qish ruxsatini so'raydi.
• Ochish: --allow-fs-read, --allow-fs-write (papka + *), --allow-child-process (PERM0002 ogohlantirishi bilan).
• process.permission.has — tekshirish, drop — qaytarib bo'lmas voz kechish; --permission-audit + diagnostics_channel — kerakli ruxsatlarni yig'ish.
• Node 24 da tarmoq cheklanmaydi (--allow-net → bad option), process.env ochiq — valyuta (api) bilan ishladi.
• Bu "xavfsizlik kamari": zararli kodga qarshi yagona himoya emas.

Keyingi dars: Node'ni debug qilish: inspector va VS Code — console.log o'rniga to'xtash nuqtalari bilan dasturni jonli kuzatish.

Manbalar

• Node.js 24 hujjati — Permissions (seat belt, cheklovlar, audit rejimi, process.permission): https://nodejs.org/docs/latest-v24.x/api/permissions.html
• Node.js 24 hujjati — CLI (--permission, --allow-*): https://nodejs.org/docs/latest-v24.x/api/cli.html
• Kanon: t44-permission (valyuta ruxsatsiz va ruxsatlar bilan, (api), --allow-net → bad option, process.permission.has). Kichik loyiha, drop, audit va PERM0002 chiqishlari — biz ishga tushirdik (Node 24.21.0, Windows 11).