src,permission: add --allow-inspector ability

Refs: #48534
PR-URL: #59711
Reviewed-By: Santiago Gimeno <[email protected]>
Reviewed-By: Juan José Arboleda <[email protected]>

Author: RafaelGSS

doc/api/cli.md

@@ -275,6 +275,36 @@ When passing a single flag with a comma a warning will be displayed.
 
 Examples can be found in the [File System Permissions][] documentation.
 
+### `--allow-inspector`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1.0 - Early development
+
+When using the [Permission Model][], the process will not be able to connect
+through inspector protocol.
+
+Attempts to do so will throw an `ERR_ACCESS_DENIED` unless the
+user explicitly passes the `--allow-inspector` flag when starting Node.js.
+
+Example:
+
+```js
+const { Session } = require('node:inspector/promises');
+
+const session = new Session();
+session.connect();
+```
+
+```console
+$ node --permission index.js
+Error: connect ERR_ACCESS_DENIED Access to this API has been restricted. Use --allow-inspector to manage permissions.
+  code: 'ERR_ACCESS_DENIED',
+}
+```
+
 ### `--allow-net`
 
 <!-- YAML
@@ -3427,6 +3457,7 @@ one is included in the list below.
 * `--allow-child-process`
 * `--allow-fs-read`
 * `--allow-fs-write`
+* `--allow-inspector`
 * `--allow-net`
 * `--allow-wasi`
 * `--allow-worker`

doc/api/permissions.md

@@ -51,7 +51,8 @@ flag.
 When starting Node.js with `--permission`,
 the ability to access the file system through the `fs` module, access the network,
 spawn processes, use `node:worker_threads`, use native addons, use WASI, and
-enable the runtime inspector will be restricted.
+enable the runtime inspector will be restricted (the listener for SIGUSR1 won't
+be created).
 
 ```console
 $ node --permission index.js

doc/node-config-schema.json

@@ -45,6 +45,9 @@
             }
           ]
         },
+        "allow-inspector": {
+          "type": "boolean"
+        },
         "allow-net": {
           "type": "boolean"
         },

doc/node.1

@@ -85,6 +85,9 @@ Allow using native addons when using the permission model.
 .It Fl -allow-child-process
 Allow spawning process when using the permission model.
 .
+.It Fl -allow-inspector
+Allow inspector access when using the permission model.
+.
 .It Fl -allow-net
 Allow network access when using the permission model.
 .

lib/internal/process/permission.js

@@ -40,6 +40,7 @@ module.exports = ObjectFreeze({
       '--allow-addons',
       '--allow-child-process',
       '--allow-net',
+      '--allow-inspector',
       '--allow-wasi',
       '--allow-worker',
     ];

lib/internal/process/pre_execution.js

@@ -580,6 +580,7 @@ function initializePermission() {
     const warnFlags = [
       '--allow-addons',
       '--allow-child-process',
+      '--allow-inspector',
       '--allow-wasi',
       '--allow-worker',
     ];

src/env.cc

@@ -912,8 +912,10 @@ Environment::Environment(IsolateData* isolate_data,
       options_->allow_native_addons = false;
       permission()->Apply(this, {"*"}, permission::PermissionScope::kAddon);
     }
-    flags_ = flags_ | EnvironmentFlags::kNoCreateInspector;
-    permission()->Apply(this, {"*"}, permission::PermissionScope::kInspector);
+    if (!options_->allow_inspector) {
+      flags_ = flags_ | EnvironmentFlags::kNoCreateInspector;
+      permission()->Apply(this, {"*"}, permission::PermissionScope::kInspector);
+    }
     if (!options_->allow_child_process) {
       permission()->Apply(
           this, {"*"}, permission::PermissionScope::kChildProcess);

src/node_options.cc

@@ -606,6 +606,10 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             "allow use of child process when any permissions are set",
             &EnvironmentOptions::allow_child_process,
             kAllowedInEnvvar);
+  AddOption("--allow-inspector",
+            "allow use of inspector when any permissions are set",
+            &EnvironmentOptions::allow_inspector,
+            kAllowedInEnvvar);
   AddOption("--allow-net",
             "allow use of network when any permissions are set",
             &EnvironmentOptions::allow_net,

src/node_options.h

@@ -141,6 +141,7 @@ class EnvironmentOptions : public Options {
   std::vector<std::string> allow_fs_read;
   std::vector<std::string> allow_fs_write;
   bool allow_addons = false;
+  bool allow_inspector = false;
   bool allow_child_process = false;
   bool allow_net = false;
   bool allow_wasi = false;

src/permission/permission_base.h

@@ -27,7 +27,8 @@ namespace permission {
 #define WORKER_THREADS_PERMISSIONS(V)                                          \
   V(WorkerThreads, "worker", PermissionsRoot, "--allow-worker")
 
-#define INSPECTOR_PERMISSIONS(V) V(Inspector, "inspector", PermissionsRoot, "")
+#define INSPECTOR_PERMISSIONS(V)                                               \
+  V(Inspector, "inspector", PermissionsRoot, "--allow-inspector")
 
 #define NET_PERMISSIONS(V) V(Net, "net", PermissionsRoot, "--allow-net")