search

nodejs / node

Node.js JavaScript runtime ✨🐢🚀✨
https://nodejs.org
Other
107.64k stars 29.61k forks source link

`--use-openssl-ca` not working with Linux capabilities set #31131

Closed wranders closed 4 years ago

wranders commented 4 years ago

Background

I'm using Xen-Orchestra to connect to servers and attempting to use an internal Certificate Authority to secure communications between the two. I've installed the root and intermediate certificates using update-ca-certificates and openssl s_client confirms that they are recognized and in use.

I'm running this application with NODE_OPTIONs=--use-openssl-ca and the CAP_NET_BIND_SERVICE capability on Node to run the application on ports 80 and 443. SSL checks return errors (SELF_SIGNED_CERT_IN_CHAIN) when trying to connect to the other servers using certificates from my internal CA.

Documentation for the NODE_EXTRA_CA_CERTS environment variable states:

This environment variable is ignored when node runs as setuid root or has Linux file capabilities set.

In a last ditch effort, I removed the capability and configured the application to run on non-privileged ports and SSL checks succeeded.

Possible Bug

Is --use-openssl-ca intended to be ignored if Linux capabilities are set, just like NODE_EXTRA_CA_CERTS, and just undocumented, or is this unintended and a bug?

bnoordhuis commented 4 years ago

Is --use-openssl-ca intended to be ignored if Linux capabilities are set

Yes. See the AT_SECURE entry in the getauxval(3) man page:

Has a nonzero value if this executable should be treated
securely.  Most commonly, a nonzero value indicates that the
process is executing a set-user-ID or set-group-ID binary (so
that its real and effective UIDs or GIDs differ from one
another), or that it gained capabilities by executing a binary
file that has capabilities

When the AT_SECURE flag is set by the kernel, node will ignore "sensitive" environment variables like NODE_EXTRA_CA_CERTS.

Node only knows it gained a capability, it doesn't know it's CAP_NET_BIND_SERVICE specifically.

wranders commented 4 years ago

Awesome, thanks for the explanation.

I'm assuming this behavior extends to the current version, not just v8? If so, I'm willing to submit a PR for the Docs on all options and EnvVars that exhibit this behavior to avoid any future confusion.

If things have changed, I don't want to waste your time with a PR based on a version that's going unmaintained in a few days.

bnoordhuis commented 4 years ago

I'm assuming this behavior extends to the current version, not just v8?

That's correct.