src,permission: emit dc messages from C++ and use --permission-audit

doc/api/cli.md

@@ -2174,6 +2174,16 @@ following permissions are restricted:
 * WASI - manageable through [`--allow-wasi`][] flag
 * Addons - manageable through [`--allow-addons`][] flag
 
+### `--permission-audit`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Enable audit only for the permission model. When enabled, permission checks
+are performed but access is not denied. Instead, a warning is emitted for
+each permission violation via diagnostics channel.
+
 ### `--preserve-symlinks`
 
 <!-- YAML
@@ -3660,6 +3670,7 @@ one is included in the list below.
 * `--openssl-legacy-provider`
 * `--openssl-shared-config`
 * `--pending-deprecation`
+* `--permission-audit`
 * `--permission`
 * `--preserve-symlinks-main`
 * `--preserve-symlinks`

doc/node.1

@@ -1115,6 +1115,11 @@ WASI - manageable through \fB--allow-wasi\fR flag
 Addons - manageable through \fB--allow-addons\fR flag
 .El
 .
+.It Fl -permission-audit
+Enable audit only for the permission model. When enabled, permission checks
+are performed but access is not denied. Instead, a warning is emitted for
+each permission violation via diagnostics channel.
+.
 .It Fl -preserve-symlinks
 Instructs the module loader to preserve symbolic links when resolving and
 caching modules.
@@ -1978,6 +1983,8 @@ one is included in the list below.
 .It
 \fB--permission\fR
 .It
+\fB--permission-audit\fR
+.It
 \fB--preserve-symlinks-main\fR
 .It
 \fB--preserve-symlinks\fR

lib/diagnostics_channel.js

@@ -31,6 +31,9 @@ const {
 
 const { triggerUncaughtException } = internalBinding('errors');
 
+const dc_binding = internalBinding('diagnostics_channel');
+const { subscribers: subscriberCounts } = dc_binding;
+
 const { WeakReference } = require('internal/util');
 
 // Can't delete when weakref count reaches 0 as it could increment again.
@@ -108,6 +111,7 @@ class ActiveChannel {
     this._subscribers = ArrayPrototypeSlice(this._subscribers);
     ArrayPrototypePush(this._subscribers, subscription);
     channels.incRef(this.name);
+    if (this._index !== undefined) subscriberCounts[this._index]++;
   }
 
   unsubscribe(subscription) {
@@ -120,14 +124,18 @@ class ActiveChannel {
     ArrayPrototypePushApply(this._subscribers, after);
 
     channels.decRef(this.name);
+    if (this._index !== undefined) subscriberCounts[this._index]--;
     maybeMarkInactive(this);
 
     return true;
   }
 
   bindStore(store, transform) {
     const replacing = this._stores.has(store);
-    if (!replacing) channels.incRef(this.name);
+    if (!replacing) {
+      channels.incRef(this.name);
+      if (this._index !== undefined) subscriberCounts[this._index]++;
+    }
     this._stores.set(store, transform);
   }
 
@@ -139,6 +147,7 @@ class ActiveChannel {
     this._stores.delete(store);
 
     channels.decRef(this.name);
+    if (this._index !== undefined) subscriberCounts[this._index]--;
     maybeMarkInactive(this);
 
     return true;
@@ -183,6 +192,9 @@ class Channel {
     this._subscribers = undefined;
     this._stores = undefined;
     this.name = name;
+    if (typeof name === 'string') {
+      this._index = dc_binding.getOrCreateChannelIndex(name);
+    }
 
     channels.set(name, this);
   }
@@ -434,6 +446,8 @@ function tracingChannel(nameOrChannels) {
   return new TracingChannel(nameOrChannels);
 }
 
+dc_binding.linkNativeChannel((name) => channel(name));
+
 module.exports = {
   channel,
   hasSubscribers,

lib/internal/process/pre_execution.js

@@ -124,6 +124,8 @@ function prepareExecution(options) {
   // Process initial diagnostic reporting configuration, if present.
   initializeReport();
 
+  setupDiagnosticsChannel();
+
   // Load permission system API
   initializePermission();
 
@@ -619,8 +621,16 @@ function initializeClusterIPC() {
   }
 }
 
+function setupDiagnosticsChannel() {
+  // Re-link native channels after snapshot deserialization since
+  // JS references are cleared during serialization.
+  const dc = require('diagnostics_channel');
+  const dc_binding = internalBinding('diagnostics_channel');
+  dc_binding.linkNativeChannel((name) => dc.channel(name));
+}
+
 function initializePermission() {
-  const permission = getOptionValue('--permission');
+  const permission = getOptionValue('--permission') || getOptionValue('--permission-audit');
   if (permission) {
     process.binding = function binding(_module) {
       throw new ERR_ACCESS_DENIED('process.binding');

node.gyp

@@ -133,6 +133,7 @@
       'src/node_main_instance.cc',
       'src/node_messaging.cc',
       'src/node_metadata.cc',
+      'src/node_diagnostics_channel.cc',
       'src/node_modules.cc',
       'src/node_options.cc',
       'src/node_os.cc',
@@ -270,6 +271,7 @@
       'src/node_messaging.h',
       'src/node_metadata.h',
       'src/node_mutex.h',
+      'src/node_diagnostics_channel.h',
       'src/node_modules.h',
       'src/node_object_wrap.h',
       'src/node_options.h',

src/base_object_types.h

@@ -10,6 +10,7 @@ namespace node {
 // what the class passes to SET_BINDING_ID(), the second argument should match
 // the C++ class name.
 #define SERIALIZABLE_BINDING_TYPES(V)                                          \
+  V(diagnostics_channel_binding_data, diagnostics_channel::BindingData)        \
   V(encoding_binding_data, encoding_binding::BindingData)                      \
   V(fs_binding_data, fs::BindingData)                                          \
   V(mksnapshot_binding_data, mksnapshot::BindingData)                          \

src/env.cc

@@ -918,8 +918,11 @@ Environment::Environment(IsolateData* isolate_data,
                                       tracing::CastTracedValue(traced_value));
   }
 
-  if (options_->permission) {
+  if (options_->permission || options_->permission_audit) {
     permission()->EnablePermissions();
+    if (options_->permission_audit) {
+      permission()->EnableWarningOnly();
+    }
     // The process shouldn't be able to neither
     // spawn/worker nor use addons or enable inspector
     // unless explicitly allowed by the user

src/node_binding.cc

@@ -48,6 +48,7 @@
   V(constants)                                                                 \
   V(contextify)                                                                \
   V(credentials)                                                               \
+  V(diagnostics_channel)                                                       \
   V(encoding_binding)                                                          \
   V(errors)                                                                    \
   V(fs)                                                                        \

src/node_binding.h

@@ -49,6 +49,7 @@ static_assert(static_cast<int>(NM_F_LINKED) ==
   V(blob)                                                                      \
   V(builtins)                                                                  \
   V(contextify)                                                                \
+  V(diagnostics_channel)                                                       \
   V(encoding_binding)                                                          \
   V(fs)                                                                        \
   V(fs_dir)                                                                    \