◐ Shell
clean mode source ↗

src,lib: stabilize permission model · nodejs/node@57bb983

@@ -126,7 +126,7 @@ require('nodejs-addon-example');

126126

```

127127128128

```console

129-

$ node --experimental-permission --allow-fs-read=* index.js

129+

$ node --permission --allow-fs-read=* index.js

130130

node:internal/modules/cjs/loader:1319

131131

return process.dlopen(module, path.toNamespacedPath(filename));

132132

^

@@ -168,7 +168,7 @@ childProcess.spawn('node', ['-e', 'require("fs").writeFileSync("/new-file", "exa

168168

```

169169170170

```console

171-

$ node --experimental-permission --allow-fs-read=* index.js

171+

$ node --permission --allow-fs-read=* index.js

172172

node:internal/child_process:388

173173

const err = this._handle.spawn(options);

174174

^

@@ -192,12 +192,15 @@ Error: Access to this API has been restricted

192192

<!-- YAML

193193

added: v20.0.0

194194

changes:

195+

- version: REPLACEME

196+

pr-url: https://github.com/nodejs/node/pull/56201

197+

description: Permission Model and --allow-fs flags are stable.

195198

- version: v20.7.0

196199

pr-url: https://github.com/nodejs/node/pull/49047

197200

description: Paths delimited by comma (`,`) are no longer allowed.

198201

-->

199202200-

> Stability: 1.1 - Active development

203+

> Stability: 2 - Stable.

201204202205

This flag configures file system read permissions using

203206

the [Permission Model][].

@@ -213,7 +216,7 @@ Examples can be found in the [File System Permissions][] documentation.

213216

The initializer module also needs to be allowed. Consider the following example:

214217215218

```console

216-

$ node --experimental-permission index.js

219+

$ node --permission index.js

217220218221

Error: Access to this API has been restricted

219222

at node:internal/main/run_main_module:23:47 {

@@ -226,20 +229,23 @@ Error: Access to this API has been restricted

226229

The process needs to have access to the `index.js` module:

227230228231

```bash

229-

node --experimental-permission --allow-fs-read=/path/to/index.js index.js

232+

node --permission --allow-fs-read=/path/to/index.js index.js

230233

```

231234232235

### `--allow-fs-write`

233236234237

<!-- YAML

235238

added: v20.0.0

236239

changes:

240+

- version: REPLACEME

241+

pr-url: https://github.com/nodejs/node/pull/56201

242+

description: Permission Model and --allow-fs flags are stable.

237243

- version: v20.7.0

238244

pr-url: https://github.com/nodejs/node/pull/49047

239245

description: Paths delimited by comma (`,`) are no longer allowed.

240246

-->

241247242-

> Stability: 1.1 - Active development

248+

> Stability: 2 - Stable.

243249244250

This flag configures file system write permissions using

245251

the [Permission Model][].

@@ -283,7 +289,7 @@ new WASI({

283289

```

284290285291

```console

286-

$ node --experimental-permission --allow-fs-read=* index.js

292+

$ node --permission --allow-fs-read=* index.js

287293288294

Error: Access to this API has been restricted

289295

at node:internal/main/run_main_module:30:49 {

@@ -314,7 +320,7 @@ new Worker(__filename);

314320

```

315321316322

```console

317-

$ node --experimental-permission --allow-fs-read=* index.js

323+

$ node --permission --allow-fs-read=* index.js

318324319325

Error: Access to this API has been restricted

320326

at node:internal/main/run_main_module:17:47 {

@@ -970,24 +976,6 @@ added:

970976971977

Enable experimental support for the network inspection with Chrome DevTools.

972978973-

### `--experimental-permission`

974-975-

<!-- YAML

976-

added: v20.0.0

977-

-->

978-979-

> Stability: 1.1 - Active development

980-981-

Enable the Permission Model for current process. When enabled, the

982-

following permissions are restricted:

983-984-

* File System - manageable through

985-

[`--allow-fs-read`][], [`--allow-fs-write`][] flags

986-

* Child Process - manageable through [`--allow-child-process`][] flag

987-

* Worker Threads - manageable through [`--allow-worker`][] flag

988-

* WASI - manageable through [`--allow-wasi`][] flag

989-

* Addons - manageable through [`--allow-addons`][] flag

990-991979

### `--experimental-print-required-tla`

992980993981

<!-- YAML

@@ -1807,6 +1795,28 @@ unless either the `--pending-deprecation` command-line flag, or the

18071795

are used to provide a kind of selective "early warning" mechanism that

18081796

developers may leverage to detect deprecated API usage.

180917971798+

### `--permission`

1799+1800+

<!-- YAML

1801+

added: v20.0.0

1802+

changes:

1803+

- version: REPLACEME

1804+

pr-url: https://github.com/nodejs/node/pull/56201

1805+

description: Permission Model is now stable.

1806+

-->

1807+1808+

> Stability: 2 - Stable.

1809+1810+

Enable the Permission Model for current process. When enabled, the

1811+

following permissions are restricted:

1812+1813+

* File System - manageable through

1814+

[`--allow-fs-read`][], [`--allow-fs-write`][] flags

1815+

* Child Process - manageable through [`--allow-child-process`][] flag

1816+

* Worker Threads - manageable through [`--allow-worker`][] flag

1817+

* WASI - manageable through [`--allow-wasi`][] flag

1818+

* Addons - manageable through [`--allow-addons`][] flag

1819+18101820

### `--preserve-symlinks`

1811182118121822

<!-- YAML

@@ -3145,6 +3155,7 @@ one is included in the list below.

31453155

* `--openssl-legacy-provider`

31463156

* `--openssl-shared-config`

31473157

* `--pending-deprecation`

3158+

* `--permission`

31483159

* `--preserve-symlinks-main`

31493160

* `--preserve-symlinks`

31503161

* `--prof-process`