-
Notifications
You must be signed in to change notification settings - Fork 35
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Investigate and improve permission prompting #31
Comments
Related to both this issue and #27, I have taken to using a shebang on executable files which lets each file declare its own permissions: #!/usr/bin/env -S deno run --allow-env=HOME,PATH --allow-net=deno.land --allow-read=. I think this could be another useful thing to include in docs (it's already in the Deno docs, which is where I got it from, e.g. https://deno.land/manual@v1.29.0/examples/hashbang). Going this route lets you invoke child scripts that can have different permissions from the calling Deno process: script-a.ts #!/usr/bin/env -S deno run --allow-env=PWD --allow-read=.
import { $ } from 'https://deno.land/x/dax/mod.ts'
const scriptB = $.path.join(Deno.env.get('PWD'), 'script-b.ts') // file with executable bit set
await $`${scriptB}` script-b.ts #!/usr/bin/env -S deno run --allow-env=HOME --allow-run=/bin/ls
import { $ } from 'https://deno.land/x/dax/mod.ts'
await $`ls -lah ${Deno.env.get('HOME')}` Could be worth a mention 👍 |
You scripts seems to have wrong permissions ?
I wonder if can any of the above be improved ? The other permissions are:
|
I was just quickly typing this as an illustrative example, not as a copy-pasteable script. You are right, more perms are typically needed for any script being run by |
I think you can do this before Deno supports native WASM modules. I haven't used WASM much myself, but as I understand it you just feed bytes into WebAddembly.Module() (example) So if you transform your .wasm file to something like base64_encoded_wasm.ts (or .js or .json), you can just import wasmBytes from "./base64_encoded.wasm.ts" This lets Shameless plug: If you don't want to base64-encode the wasm file yourself, you could use deno-embedder, which I wrote to do just this kind of thing. |
There is an option in wasmbuild (which dax uses to build the wasm file) to do that: https://github.com/denoland/wasmbuild#cli-flags ( |
@NfNitLoop deno-embedder looks nice! |
As for cwd/HOME -- #!/usr/bin/env -S deno run --allow-run
const result = await new Deno.Command("env").output()
const outText = new TextDecoder().decode(result.stdout)
console.log(outText) (Update): Aha, I see. Some of the built-in commands like Context: I'd avoided using Dax for a while because my very first experience with it was it asking for permissions to environment variables and reading/writing local directories, and network access, which seemed strange. (yes, even in the face of giving it Months later, I was quickly making a script and forgot about my issues. This time I just threw on an I'd love to use Dax while granting it fewer permissions! |
@dsherret I'm not sure if my PR link 2 days ago sent a notification to this issue, so just in case it didn't, see the above. 😊 I created a simple benchmark to test the "before" performance. Then I converted to use the |
Thanks, @NfNitLoop! That was a big improvement.
I agree. I'm actually probably doing a lightning talk on this subject next month at a conference. |
I think the permission prompting could be a little better and explanatory.
Edit: investigated all permission prompts...
cwd
option.clearEnv()
in the future.The text was updated successfully, but these errors were encountered: