src: let embedders exempt linked bindings from the addon permission by codebytere · Pull Request #66067 · nodejs/node

codebytere · 2026-09-16T13:17:52Z

Since #65432 process._linkedBinding() is subject to the permission model's addon scope, the same as process.dlopen(). A stock node binary has no linked bindings, so this only affects embedders, and for an embedder that implements part of its runtime as linked bindings (NODE_LINKED_MODULE / node::AddLinkedBinding()) it means its own bootstrap cannot reach them under --permission unless the user also passes --allow-addons - which then allows loading addons from the file system as well.

This adds EnvironmentFlags::kNoAddonPermissionForLinkedBindings. When an embedder sets it, GetLinkedBinding() skips the addon permission check for that Environment and the worker threads it creates; process.dlopen() stays gated by --allow-addons and the default behavior is unchanged. The reasoning is that --allow-addons guards loading native code from disk at runtime, while linked bindings are compiled into the executable by the embedder and trusted the same way the built-in bindings are.

Disclosure: the code, tests and this description were written by Claude Code, directed and reviewed by @codebytere.

process._linkedBinding() is subject to the permission model's addon scope since the check was added to GetLinkedBinding(). For an embedder that implements part of its runtime as linked bindings this means its own bootstrap cannot reach them under --permission unless the user also passes --allow-addons, which allows loading addons from the file system as well. Add EnvironmentFlags::kNoAddonPermissionForLinkedBindings. When set, GetLinkedBinding() skips the addon permission check for that Environment and the worker threads it creates; process.dlopen() stays gated and the default behavior is unchanged. Refs: nodejs#65432 Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>

codecov · 2026-09-16T15:10:07Z

Codecov Report

❌ Patch coverage is 50.00000% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.26%. Comparing base (67e66b8) to head (eee9f6c).
⚠️ Report is 67 commits behind head on main.

Files with missing lines	Patch %	Lines
src/node_worker.cc	0.00%	2 Missing and 1 partial ⚠️
src/node_binding.cc	66.66%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #66067      +/-   ##
==========================================
- Coverage   90.27%   90.26%   -0.01%     
==========================================
  Files         789      789              
  Lines      271473   271480       +7     
  Branches    51808    51815       +7     
==========================================
- Hits       245066   245064       -2     
- Misses      16880    16885       +5     
- Partials     9527     9531       +4

Files with missing lines	Coverage Δ
src/env-inl.h	`93.95% <100.00%> (+0.02%)`	⬆️
src/env.h	`97.26% <ø> (ø)`
src/node.h	`91.66% <ø> (ø)`
src/node_binding.cc	`70.79% <66.66%> (+0.16%)`	⬆️
src/node_worker.cc	`82.05% <0.00%> (-0.05%)`	⬇️

... and 27 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nodejs-github-bot · 2026-09-17T07:28:02Z

CI: https://ci.nodejs.org/job/node-test-pull-request/77558/

nodejs-github-bot · 2026-09-18T17:55:00Z

CI: https://ci.nodejs.org/job/node-test-pull-request/77618/

nodejs-github-bot · 2026-09-19T08:27:46Z

CI: https://ci.nodejs.org/job/node-test-pull-request/77630/

nodejs-github-bot · 2026-09-20T12:58:14Z

Landed in 25e6c15

process._linkedBinding() is subject to the permission model's addon scope since the check was added to GetLinkedBinding(). For an embedder that implements part of its runtime as linked bindings this means its own bootstrap cannot reach them under --permission unless the user also passes --allow-addons, which allows loading addons from the file system as well. Add EnvironmentFlags::kNoAddonPermissionForLinkedBindings. When set, GetLinkedBinding() skips the addon permission check for that Environment and the worker threads it creates; process.dlopen() stays gated and the default behavior is unchanged. Refs: #65432 Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com> PR-URL: #66067 Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Xuguang Mei <meixuguang@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

Notable changes: benchmark: * (SEMVER-MINOR) add http header validator benchmark (James M Snell) #66334 buffer: * (SEMVER-MINOR) add isLatin1 (James M Snell) #66298 * (SEMVER-MINOR) add isLatin1 (James M Snell) #66298 * (SEMVER-MINOR) add Buffer.stringLength() (Matteo Collina) #66064 build, doc: * move to redesign (Aviv Keller) #62045 http: * (SEMVER-MINOR) add isValidHeaderName() and isValidHeaderValue() (James M Snell) #66334 http2: * (SEMVER-MINOR) add new connectionWindowSize option (Tim Perry) #65619 lib: * (SEMVER-MINOR) fix stream loading bug in node:bench (James M Snell) #66114 perf_hooks: * (SEMVER-MINOR) fix truncation of monitorEventLoopDelay() resolution (James M Snell) #66115 * (SEMVER-MINOR) allow RecordableHistogram to record 0 (James M Snell) #66114 * (SEMVER-MINOR) add histogram.diff() (James M Snell) #66099 * (SEMVER-MINOR) report histogram memory to V8 (James M Snell) #66099 * (SEMVER-MINOR) add histogram.snapshot() (James M Snell) #66099 * (SEMVER-MINOR) add histogram export format version 2 (James M Snell) #66098 * (SEMVER-MINOR) harden histogram CBOR import validation (James M Snell) #66098 process: * (SEMVER-MINOR) graduate process.ref/unref from experimental (James M Snell) #66213 sqlite: * (SEMVER-MINOR) rename DatabaseSync and StatementSync (Guilherme Araújo) #65988 src: * (SEMVER-MINOR) add --process-timeout=N (James M Snell) #66138 * (SEMVER-MINOR) expose size and count in heap profile output (Ilyas Shabi) #65737 * (SEMVER-MINOR) let embedders exempt linked bindings from the addon permission (Shelley Vohr) #66067 test: * deflake sliding window histogram test (James M Snell) #66132 PR-URL: #66546

Notable changes: buffer: * (SEMVER-MINOR) add isLatin1 (James M Snell) #66298 * (SEMVER-MINOR) add Buffer.stringLength() (Matteo Collina) #66064 build, doc: * move to redesign (Aviv Keller) #62045 http: * (SEMVER-MINOR) add isValidHeaderName() and isValidHeaderValue() (James M Snell) #66334 http2: * (SEMVER-MINOR) add new connectionWindowSize option (Tim Perry) #65619 perf_hooks: * (SEMVER-MINOR) fix truncation of monitorEventLoopDelay() resolution (James M Snell) #66115 * (SEMVER-MINOR) allow RecordableHistogram to record 0 (James M Snell) #66114 * (SEMVER-MINOR) add histogram.diff() (James M Snell) #66099 * (SEMVER-MINOR) report histogram memory to V8 (James M Snell) #66099 * (SEMVER-MINOR) add histogram.snapshot() (James M Snell) #66099 * (SEMVER-MINOR) add histogram export format version 2 (James M Snell) #66098 * (SEMVER-MINOR) harden histogram CBOR import validation (James M Snell) #66098 process: * (SEMVER-MINOR) graduate process.ref/unref from experimental (James M Snell) #66213 sqlite: * (SEMVER-MINOR) rename DatabaseSync and StatementSync (Guilherme Araújo) #65988 src: * (SEMVER-MINOR) add --process-timeout=N (James M Snell) #66138 * (SEMVER-MINOR) expose size and count in heap profile output (Ilyas Shabi) #65737 * (SEMVER-MINOR) let embedders exempt linked bindings from the addon permission (Shelley Vohr) #66067 PR-URL: #66546

Notable changes: buffer: * (SEMVER-MINOR) add isLatin1 (James M Snell) #66298 * (SEMVER-MINOR) add Buffer.stringLength() (Matteo Collina) #66064 build, doc: * move to redesign (Aviv Keller) #62045 doc: * promote Alpine Linux to tier 2 support (Stewart X Addison) #63737 http: * (SEMVER-MINOR) add isValidHeaderName() and isValidHeaderValue() (James M Snell) #66334 http2: * (SEMVER-MINOR) add new connectionWindowSize option (Tim Perry) #65619 perf_hooks: * (SEMVER-MINOR) fix truncation of monitorEventLoopDelay() resolution (James M Snell) #66115 * (SEMVER-MINOR) allow RecordableHistogram to record 0 (James M Snell) #66114 * (SEMVER-MINOR) add histogram.diff() (James M Snell) #66099 * (SEMVER-MINOR) add histogram.snapshot() (James M Snell) #66099 * (SEMVER-MINOR) harden histogram CBOR import validation (James M Snell) #66098 process: * (SEMVER-MINOR) graduate process.ref/unref from experimental (James M Snell) #66213 sqlite: * (SEMVER-MINOR) rename DatabaseSync and StatementSync (Guilherme Araújo) #65988 src: * (SEMVER-MINOR) add --process-timeout=N (James M Snell) #66138 * (SEMVER-MINOR) expose size and count in heap profile output (Ilyas Shabi) #65737 * (SEMVER-MINOR) let embedders exempt linked bindings from the addon permission (Shelley Vohr) #66067 PR-URL: #66546

nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs involving general changes in the lib/ or src/ directories. needs-ci PRs that need a full CI run. labels Sep 16, 2026

codebytere added semver-minor PRs that contain new features and should be released in the next minor version. embedding Issues and PRs related to embedding Node.js in another project. labels Sep 16, 2026

codebytere requested review from Qard, RafaelGSS and legendecas September 16, 2026 15:11

legendecas approved these changes Sep 16, 2026

View reviewed changes

meixg approved these changes Sep 17, 2026

View reviewed changes

codebytere added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Sep 17, 2026

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Sep 17, 2026

jasnell approved these changes Sep 18, 2026

View reviewed changes

codebytere added the commit-queue PRs queued for automated landing through the Commit Queue. label Sep 20, 2026

nodejs-github-bot merged commit 25e6c15 into nodejs:main Sep 20, 2026
95 checks passed

nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label Sep 20, 2026

github-actions Bot mentioned this pull request Oct 5, 2026

2026-10-07, Version 26.11.0 (Current) #66546

Open

Navigation Menu

Repository navigation

src: let embedders exempt linked bindings from the addon permission - #66067

src: let embedders exempt linked bindings from the addon permission#66067
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
codebytere:embedder-linked-binding-permission

codebytere commented Sep 16, 2026

Uh oh!

codecov Bot commented Sep 16, 2026 •

edited

Loading

Uh oh!

nodejs-github-bot commented Sep 17, 2026

Uh oh!

nodejs-github-bot commented Sep 18, 2026

Uh oh!

nodejs-github-bot commented Sep 19, 2026

Uh oh!

Uh oh!

nodejs-github-bot commented Sep 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

codebytere commented Sep 16, 2026

Uh oh!

codecov Bot commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

nodejs-github-bot commented Sep 17, 2026

Uh oh!

nodejs-github-bot commented Sep 18, 2026

Uh oh!

nodejs-github-bot commented Sep 19, 2026

Uh oh!

Uh oh!

nodejs-github-bot commented Sep 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

codecov Bot commented Sep 16, 2026 •

edited

Loading