Cannot read files from `/proc/self/fd` since Deno 1.43 about deno HOT 8 CLOSED

I think we might be able to make this work without relaxing the security sandbox -- we'll allow opening FD magic links on unix systems, but only if they are not stdio, and are pipes.

from deno.

With some changes in 1.43 this unfortunately requires --allow-all now, as we don't currently have a way to discriminate between pipes and files in /dev/fd and /proc/self/fd. I think we may be able to improve this situation.

from deno.

Looks like a lot more is now disallowed which is a big breaking change.

Here is an example from the docs:

$ deno run --allow-read=/etc https://deno.land/[email protected]/examples/cat.ts /etc/passwd
error: Uncaught (in promise) PermissionDenied: permission denied: open '/etc/passwd'
  const file = await Deno.open(filename);
                          ^
    at Object.open (ext:deno_fs/30_fs.js:633:21)
    at https://deno.land/[email protected]/examples/cat.ts:10:27

Moving from --allow-read to --allow-all is very questionable.

from deno.

I personally don't mind adding more granularity to the --allow flags (supposing some new flag will come to allow these extra use cases).

I just don't think it's a good idea to do it in Deno 1.x.

from deno.

Looks like a lot more is now disallowed which is a big breaking change.

Here is an example from the docs:

$ deno run --allow-read=/etc https://deno.land/[email protected]/examples/cat.ts /etc/passwd
error: Uncaught (in promise) PermissionDenied: permission denied: open '/etc/passwd'
  const file = await Deno.open(filename);
                          ^
    at Object.open (ext:deno_fs/30_fs.js:633:21)
    at https://deno.land/[email protected]/examples/cat.ts:10:27

Moving from --allow-read to --allow-all is very questionable.

This has been relaxed by #23718 and will work again in v1.43.2.

I personally don't mind adding more granularity to the --allow flags (supposing some new flag will come to allow these extra use cases).

I just don't think it's a good idea to do it in Deno 1.x.

That's true, but we had to do it because of the security vulnerability that you can see at GHSA-23rx-c3g5-hv9w.

from deno.

Maybe supporting --allow-read=/dev/fd or --allow-read=/proc/self/fd is enough? User would be being explicit about it.

from deno.

@felipecrs Read access to /dev/fd allows bypassing all kinds of --allow-* permissions - so we are unlikely to reconsider for /dev/fd or /dev/self/fd. For more info, see: GHSA-23rx-c3g5-hv9w

from deno.

I see. -A then. Feel free to close this issue.

from deno.