Upload Kmake

test/fixtures/permission/deny/protected-file.md

@@ -0,0 +1,3 @@
+# Protected File
+
+Example of a protected file to be used in the PolicyDenyFs module

test/fixtures/permission/deny/protected-folder/protected-file.md

@@ -0,0 +1,3 @@
+# Protected File
+
+Example of a protected file to be used in the PolicyDenyFs module

test/fixtures/permission/fs-read-loader.js

@@ -0,0 +1,15 @@
+const fs = require('node:fs')
+const path = require('node:path')
+const assert = require('node:assert');
+
+{
+  fs.readFileSync(__filename);
+  console.log('Read its own contents') // Should not throw
+}
+{
+  const simpleLoaderPath = path.join(__dirname, 'simple-loader.js');
+  fs.readFile(simpleLoaderPath, (err) => {
+    assert.ok(err.code, 'ERR_ACCESS_DENIED');
+    assert.ok(err.permission, 'FileSystemRead');
+  }); // Should throw ERR_ACCESS_DENIED
+}

test/fixtures/permission/fs-read.js

@@ -0,0 +1,499 @@
+'use strict';
+
+const common = require('../../common');
+
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { pathToFileURL } = require('url');
+
+const blockedFile = process.env.BLOCKEDFILE;
+const bufferBlockedFile = Buffer.from(process.env.BLOCKEDFILE);
+const blockedFileURL = pathToFileURL(process.env.BLOCKEDFILE);
+const blockedFolder = process.env.BLOCKEDFOLDER;
+const allowedFolder = process.env.ALLOWEDFOLDER;
+const regularFile = __filename;
+
+// Guarantee the error message suggest the --allow-fs-read
+{
+  fs.readFile(blockedFile, common.expectsError({
+    message: 'Access to this API has been restricted. Use --allow-fs-read to manage permissions.',
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+}
+
+// fs.readFile
+{
+  fs.readFile(blockedFile, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  fs.readFile(bufferBlockedFile, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  assert.throws(() => {
+    fs.readFileSync(blockedFile);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  assert.throws(() => {
+    fs.readFileSync(blockedFileURL);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+}
+
+// fs.createReadStream
+{
+  assert.rejects(() => {
+    return new Promise((_resolve, reject) => {
+      const stream = fs.createReadStream(blockedFile);
+      stream.on('error', reject);
+    });
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  })).then(common.mustCall());
+  assert.rejects(() => {
+    return new Promise((_resolve, reject) => {
+      const stream = fs.createReadStream(blockedFileURL);
+      stream.on('error', reject);
+    });
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  })).then(common.mustCall());
+
+  assert.rejects(() => {
+    return new Promise((_resolve, reject) => {
+      const stream = fs.createReadStream(blockedFile);
+      stream.on('error', reject);
+    });
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  })).then(common.mustCall());
+}
+
+// fs.stat
+{
+  fs.stat(blockedFile, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  fs.stat(bufferBlockedFile, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  assert.throws(() => {
+    fs.statSync(blockedFile);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  assert.throws(() => {
+    fs.statSync(blockedFileURL);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  fs.stat(path.join(blockedFolder, 'anyfile'), common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(path.join(blockedFolder, 'anyfile')),
+  }));
+
+  // doesNotThrow
+  fs.stat(regularFile, (err) => {
+    assert.ifError(err);
+  });
+}
+
+// fs.access
+{
+  fs.access(blockedFile, fs.constants.R_OK, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  fs.access(bufferBlockedFile, fs.constants.R_OK, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  assert.throws(() => {
+    fs.accessSync(blockedFileURL, fs.constants.R_OK);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  assert.throws(() => {
+    fs.accessSync(path.join(blockedFolder, 'anyfile'), fs.constants.R_OK);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(path.join(blockedFolder, 'anyfile')),
+  }));
+
+  // doesNotThrow
+  fs.access(regularFile, fs.constants.R_OK, (err) => {
+    assert.ifError(err);
+  });
+}
+
+// fs.copyFile
+{
+  fs.copyFile(blockedFile, path.join(blockedFolder, 'any-other-file'), common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  fs.copyFile(bufferBlockedFile, path.join(blockedFolder, 'any-other-file'), common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  assert.throws(() => {
+    fs.copyFileSync(blockedFileURL, path.join(blockedFolder, 'any-other-file'));
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  assert.throws(() => {
+    fs.copyFileSync(blockedFile, path.join(__dirname, 'any-other-file'));
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+}
+
+// fs.cp
+{
+  assert.throws(() => {
+    fs.cpSync(blockedFile, path.join(blockedFolder, 'any-other-file'));
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  assert.throws(() => {
+    fs.cpSync(bufferBlockedFile, path.join(blockedFolder, 'any-other-file'));
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  assert.throws(() => {
+    fs.cpSync(blockedFileURL, path.join(blockedFolder, 'any-other-file'));
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  assert.throws(() => {
+    fs.cpSync(blockedFile, path.join(__dirname, 'any-other-file'));
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+}
+
+// fs.open
+{
+  fs.open(blockedFile, 'r', common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  fs.open(bufferBlockedFile, 'r', common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  assert.throws(() => {
+    fs.openSync(blockedFileURL, 'r');
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  assert.throws(() => {
+    fs.openSync(path.join(blockedFolder, 'anyfile'), 'r');
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(path.join(blockedFolder, 'anyfile')),
+  }));
+
+  // doesNotThrow
+  fs.open(regularFile, 'r', (err) => {
+    assert.ifError(err);
+  });
+
+  // Extra flags should not enable trivially bypassing all restrictions.
+  // See https://github.com/nodejs/node/issues/47090.
+  assert.throws(() => {
+    fs.openSync(blockedFile, fs.constants.O_RDONLY | fs.constants.O_NOCTTY);
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+  });
+  fs.open(blockedFile, fs.constants.O_RDWR | 0x10000000, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+  }));
+}
+
+// fs.opendir
+{
+  fs.opendir(blockedFolder, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFolder),
+  }));
+  assert.throws(() => {
+    fs.opendirSync(blockedFolder);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFolder),
+  }));
+  // doesNotThrow
+  fs.opendir(allowedFolder, (err, dir) => {
+    assert.ifError(err);
+    dir.closeSync();
+  });
+}
+
+// fs.readdir
+{
+  fs.readdir(blockedFolder, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFolder),
+  }));
+  assert.throws(() => {
+    fs.readdirSync(blockedFolder, { recursive: true });
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFolder),
+  }));
+  fs.readdir(blockedFolder, { recursive: true }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFolder),
+  }));
+  assert.throws(() => {
+    fs.readdirSync(blockedFolder);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFolder),
+  }));
+
+  // doesNotThrow
+  fs.readdir(allowedFolder, (err) => {
+    assert.ifError(err);
+  });
+}
+
+// fs.watch
+{
+  assert.throws(() => {
+    fs.watch(blockedFile, () => {});
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  assert.throws(() => {
+    fs.watch(blockedFileURL, () => {});
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+
+  // doesNotThrow
+  fs.readdir(allowedFolder, (err) => {
+    assert.ifError(err);
+  });
+}
+
+// fs.watchFile
+{
+  assert.throws(() => {
+    fs.watchFile(blockedFile, common.mustNotCall());
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  assert.throws(() => {
+    fs.watchFile(blockedFileURL, common.mustNotCall());
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+}
+
+// fs.rename
+{
+  fs.rename(blockedFile, 'newfile', common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  fs.rename(bufferBlockedFile, 'newfile', common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  assert.throws(() => {
+    fs.renameSync(blockedFile, 'newfile');
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  assert.throws(() => {
+    fs.renameSync(blockedFileURL, 'newfile');
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+}
+
+// fs.openAsBlob
+{
+  assert.throws(() => {
+    fs.openAsBlob(blockedFile);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  assert.throws(() => {
+    fs.openAsBlob(bufferBlockedFile);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  assert.throws(() => {
+    fs.openAsBlob(blockedFileURL);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+}
+
+// fs.exists
+{
+  // It will return false (without performing IO) when permissions is not met
+  fs.exists(blockedFile, (exists) => {
+    assert.equal(exists, false);
+  });
+  fs.exists(blockedFileURL, (exists) => {
+    assert.equal(exists, false);
+  });
+  assert.throws(() => {
+    fs.existsSync(blockedFile);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+}
+
+// fs.statfs
+{
+  fs.statfs(blockedFile, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  fs.statfs(bufferBlockedFile, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  assert.throws(() => {
+    fs.statfsSync(blockedFile);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  assert.throws(() => {
+    fs.statfsSync(blockedFileURL);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+}
+
+// process.chdir
+{
+  assert.throws(() => {
+    process.chdir(blockedFolder);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: blockedFolder,
+  }));
+}
+
+// fs.lstat
+{
+  assert.throws(() => {
+    fs.lstatSync(blockedFile);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+  }));
+  assert.throws(() => {
+    fs.lstatSync(bufferBlockedFile);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+  }));
+  assert.throws(() => {
+    fs.lstatSync(path.join(blockedFolder, 'anyfile'));
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+  }));
+  assert.throws(() => {
+    fs.lstatSync(bufferBlockedFile);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+  }));
+
+  // doesNotThrow
+  fs.lstat(regularFile, (err) => {
+    assert.ifError(err);
+  });
+}

test/fixtures/permission/fs-symlink-target-write.js

@@ -0,0 +1,79 @@
+'use strict'
+
+const common = require('../../common');
+
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+
+const readOnlyFolder = process.env.READONLYFOLDER;
+const readWriteFolder = process.env.READWRITEFOLDER;
+const writeOnlyFolder = process.env.WRITEONLYFOLDER;
+
+{
+  assert.ok(!process.permission.has('fs.write', readOnlyFolder));
+  assert.ok(!process.permission.has('fs.read', writeOnlyFolder));
+  assert.ok(process.permission.has('fs.write', readWriteFolder));
+
+  assert.ok(process.permission.has('fs.write', writeOnlyFolder));
+  assert.ok(process.permission.has('fs.read', readOnlyFolder));
+  assert.ok(process.permission.has('fs.read', readWriteFolder));
+}
+
+{
+  // App won't be able to symlink from a readOnlyFolder
+  assert.throws(() => {
+    fs.symlinkSync(path.join(readOnlyFolder, 'file'), path.join(readWriteFolder, 'link-to-read-only'), 'file');
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(path.join(readOnlyFolder, 'file')),
+  }));
+  assert.throws(() => {
+    fs.linkSync(path.join(readOnlyFolder, 'file'), path.join(readWriteFolder, 'link-to-read-only'));
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(path.join(readOnlyFolder, 'file')),
+  }));
+
+  // App will be able to symlink to a writeOnlyFolder
+  fs.symlink(path.join(readWriteFolder, 'file'), path.join(writeOnlyFolder, 'link-to-read-write'), 'file', (err) => {
+    assert.ifError(err);
+    // App will won't be able to read the symlink
+    fs.readFile(path.join(writeOnlyFolder, 'link-to-read-write'), common.expectsError({
+      code: 'ERR_ACCESS_DENIED',
+      permission: 'FileSystemRead',
+    }));
+
+    // App will be able to write to the symlink
+    fs.writeFile(path.join(writeOnlyFolder, 'link-to-read-write'), 'some content', common.mustSucceed());
+  });
+  fs.link(path.join(readWriteFolder, 'file'), path.join(writeOnlyFolder, 'link-to-read-write2'), (err) => {
+    assert.ifError(err);
+    // App will won't be able to read the link
+    fs.readFile(path.join(writeOnlyFolder, 'link-to-read-write2'), common.expectsError({
+      code: 'ERR_ACCESS_DENIED',
+      permission: 'FileSystemRead',
+    }));
+
+    // App will be able to write to the link
+    fs.writeFile(path.join(writeOnlyFolder, 'link-to-read-write2'), 'some content', common.mustSucceed());
+  });
+
+  // App won't be able to symlink to a readOnlyFolder
+  assert.throws(() => {
+    fs.symlinkSync(path.join(readWriteFolder, 'file'), path.join(readOnlyFolder, 'link-to-read-only'), 'file');
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(path.join(readOnlyFolder, 'link-to-read-only')),
+  }));
+  assert.throws(() => {
+    fs.linkSync(path.join(readWriteFolder, 'file'), path.join(readOnlyFolder, 'link-to-read-only'));
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(path.join(readOnlyFolder, 'link-to-read-only')),
+  }));
+}

test/fixtures/permission/fs-symlink.js

@@ -0,0 +1,93 @@
+'use strict'
+
+const common = require('../../common');
+
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+
+const blockedFolder = process.env.BLOCKEDFOLDER;
+const blockedFile = process.env.BLOCKEDFILE;
+const regularFile = __filename;
+const symlinkFromBlockedFile = process.env.EXISTINGSYMLINK;
+
+{
+  assert.ok(!process.permission.has('fs.read', blockedFile))
+  assert.ok(!process.permission.has('fs.read', blockedFolder))
+  assert.ok(!process.permission.has('fs.write', blockedFile))
+  assert.ok(!process.permission.has('fs.write', blockedFolder))
+}
+
+{
+  // Previously created symlink are NOT affected by the permission model
+  const linkData = fs.readlinkSync(symlinkFromBlockedFile);
+  assert.ok(linkData);
+  const fileData = fs.readFileSync(symlinkFromBlockedFile);
+  assert.ok(fileData);
+  // cleanup
+  fs.unlink(symlinkFromBlockedFile, (err) => {
+    assert.ifError(
+      err,
+      `Error while removing the symlink: ${symlinkFromBlockedFile}.
+      You may need to remove it manually to re-run the tests`
+    );
+  });
+}
+
+{
+  // App doesn’t have access to the BLOCKFOLDER
+  assert.throws(() => {
+    fs.opendirSync(blockedFolder);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+  }));
+  assert.throws(() => {
+    fs.writeFileSync(blockedFolder + '/new-file', 'data');
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  }));
+
+  // App doesn’t have access to the BLOCKEDFILE folder
+  assert.throws(() => {
+    fs.readFileSync(blockedFile);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+  }));
+  assert.throws(() => {
+    fs.appendFileSync(blockedFile, 'data');
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  }));
+
+  // App won't be able to symlink REGULARFILE to BLOCKFOLDER/asdf
+  assert.throws(() => {
+    fs.symlinkSync(regularFile, blockedFolder + '/asdf', 'file');
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  }));
+  assert.throws(() => {
+    fs.linkSync(regularFile, blockedFolder + '/asdf');
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  }));
+
+  // App won't be able to symlink BLOCKEDFILE to REGULARDIR
+  assert.throws(() => {
+    fs.symlinkSync(blockedFile, path.join(__dirname, '/asdf'), 'file');
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+  }));
+  assert.throws(() => {
+    fs.linkSync(blockedFile, path.join(__dirname, '/asdf'));
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+  }));
+}

test/fixtures/permission/fs-traversal.js

@@ -0,0 +1,128 @@
+'use strict'
+
+const common = require('../../common');
+
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+
+const { resolve } = path;
+// This should not affect how the permission model resolves paths.
+try {
+  path.resolve = (s) => s;
+  assert.fail('should not be called');
+} catch {}
+
+const blockedFolder = process.env.BLOCKEDFOLDER;
+const allowedFolder = process.env.ALLOWEDFOLDER;
+const traversalPath = allowedFolder + '/../file.md';
+const traversalFolderPath = allowedFolder + '/../folder';
+const bufferTraversalPath = Buffer.from(traversalPath);
+const uint8ArrayTraversalPath = new TextEncoder().encode(traversalPath);
+
+{
+  assert.ok(process.permission.has('fs.read', allowedFolder));
+  assert.ok(process.permission.has('fs.write', allowedFolder));
+  assert.ok(!process.permission.has('fs.read', blockedFolder));
+  assert.ok(!process.permission.has('fs.write', blockedFolder));
+}
+
+{
+  fs.writeFile(traversalPath, 'test', common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(traversalPath),
+  }));
+}
+
+{
+  fs.readFile(traversalPath, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(traversalPath),
+  }));
+}
+
+{
+  assert.throws(() => {
+    fs.mkdtempSync(traversalFolderPath);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: traversalFolderPath + 'XXXXXX',
+  }));
+}
+
+{
+  fs.mkdtemp(traversalFolderPath, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: traversalFolderPath + 'XXXXXX',
+  }));
+}
+
+{
+  fs.readFile(bufferTraversalPath, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(traversalPath),
+  }));
+}
+
+{
+  fs.lstat(bufferTraversalPath, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    // lstat checks and throw on JS side.
+    // resource is only resolved on C++ (is_granted)
+    resource: bufferTraversalPath.toString(),
+  }));
+}
+
+{
+  fs.readFile(uint8ArrayTraversalPath, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(traversalPath),
+  }));
+}
+
+// Monkey-patching Buffer internals should also not allow path traversal.
+{
+  const extraChars = '.'.repeat(40);
+  const traversalPathWithExtraChars = traversalPath + extraChars;
+  const traversalPathWithExtraBytes = Buffer.from(traversalPathWithExtraChars);
+
+  Buffer.prototype.utf8Write = ((w) => function(str, ...args) {
+    assert.strictEqual(str, resolve(traversalPath) + extraChars);
+    return w.apply(this, [traversalPath, ...args]);
+  })(Buffer.prototype.utf8Write);
+
+  // Sanity check (remove if the internals of Buffer.from change):
+  // The custom implementation of utf8Write should cause Buffer.from() to encode
+  // traversalPath instead of the sanitized output of resolve().
+  assert.strictEqual(Buffer.from(resolve(traversalPathWithExtraChars)).toString(), traversalPath);
+
+  assert.throws(() => {
+    fs.readFileSync(traversalPathWithExtraBytes);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(traversalPathWithExtraChars),
+  }));
+
+  assert.throws(() => {
+    fs.readFileSync(new TextEncoder().encode(traversalPathWithExtraBytes.toString()));
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(traversalPathWithExtraChars),
+  }));
+}
+
+{
+  assert.ok(!process.permission.has('fs.read', traversalPath));
+  assert.ok(!process.permission.has('fs.write', traversalPath));
+  assert.ok(!process.permission.has('fs.read', traversalFolderPath));
+  assert.ok(!process.permission.has('fs.write', traversalFolderPath));
+}

test/fixtures/permission/fs-wildcard.js

@@ -0,0 +1,80 @@
+'use strict'
+
+const common = require('../../common');
+
+const assert = require('assert');
+const fs = require('fs');
+
+{
+  assert.throws(() => {
+    fs.readFileSync('/test.txt');
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+  }));
+  // doesNotThrow
+  fs.readFile('/tmp/foo/file', (err) => {
+    // Will throw ENOENT
+    assert.notEqual(err.code, 'ERR_ACCESS_DENIED');
+  });
+}
+
+{
+  // doesNotThrow
+  fs.readFile('/example/foo/file', (err) => {
+    assert.notEqual(err.code, 'ERR_ACCESS_DENIED');
+  });
+
+  fs.readFile('/example/foo2/file', (err) => {
+    assert.notEqual(err.code, 'ERR_ACCESS_DENIED');
+  });
+
+  fs.readFile('/example/foo2', (err) => {
+    assert.notEqual(err.code, 'ERR_ACCESS_DENIED');
+  });
+
+  assert.throws(() => {
+    fs.readFileSync('/example/fo/foo2.js');
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+  }));
+  assert.throws(() => {
+    fs.readFileSync('/example/for');
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+  }));
+}
+
+{
+  // doesNotThrow
+  fs.readFile('/example/bar/file', (err) => {
+    assert.notEqual(err.code, 'ERR_ACCESS_DENIED');
+  });
+  fs.readFile('/example/bar2/file', (err) => {
+    assert.notEqual(err.code, 'ERR_ACCESS_DENIED');
+  });
+  fs.readFile('/example/bar', (err) => {
+    assert.notEqual(err.code, 'ERR_ACCESS_DENIED');
+  });
+
+  assert.throws(() => {
+    fs.readFileSync('/example/ba/foo2.js');
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+  }));
+}
+
+{
+  fs.readFile('/folder/a/subfolder/b', (err) => {
+    assert.notEqual(err.code, 'ERR_ACCESS_DENIED');
+  });
+  fs.readFile('/folder/a/subfolder/b/c.txt', (err) => {
+    assert.notEqual(err.code, 'ERR_ACCESS_DENIED');
+  });
+  fs.readFile('/folder/a/foo2.js', (err) => {
+    assert.notEqual(err.code, 'ERR_ACCESS_DENIED');
+  });
+}

test/fixtures/permission/fs-write.js

@@ -0,0 +1,569 @@
+'use strict';
+
+const common = require('../../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+
+const regularFolder = process.env.ALLOWEDFOLDER;
+const regularFile = process.env.ALLOWEDFILE;
+const blockedFolder = process.env.BLOCKEDFOLDER;
+const blockedFile = process.env.BLOCKEDFILE;
+const bufferBlockedFile = Buffer.from(process.env.BLOCKEDFILE);
+const blockedFileURL = require('url').pathToFileURL(process.env.BLOCKEDFILE);
+const relativeProtectedFile = process.env.RELATIVEBLOCKEDFILE;
+const relativeProtectedFolder = process.env.RELATIVEBLOCKEDFOLDER;
+
+{
+  assert.ok(!process.permission.has('fs.write', blockedFolder));
+  assert.ok(!process.permission.has('fs.write', blockedFile));
+}
+
+// Guarantee the error message suggest the --allow-fs-write
+{
+  fs.writeFile(blockedFile, 'example', common.expectsError({
+    message: 'Access to this API has been restricted. Use --allow-fs-write to manage permissions.',
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  }));
+}
+
+// fs.writeFile
+{
+  assert.throws(() => {
+    fs.writeFileSync(blockedFile, 'example');
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(blockedFile),
+  });
+  fs.writeFile(blockedFile, 'example', common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  fs.writeFile(bufferBlockedFile, 'example', common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  assert.throws(() => {
+    fs.writeFileSync(blockedFileURL, 'example');
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(blockedFile),
+  });
+  assert.throws(() => {
+    fs.writeFileSync(relativeProtectedFile, 'example');
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(relativeProtectedFile),
+  });
+
+  assert.throws(() => {
+    fs.writeFileSync(path.join(blockedFolder, 'anyfile'), 'example');
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(path.join(blockedFolder, 'anyfile')),
+  });
+}
+
+// fs.createWriteStream
+{
+  assert.rejects(() => {
+    return new Promise((_resolve, reject) => {
+      const stream = fs.createWriteStream(blockedFile);
+      stream.on('error', reject);
+    });
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(blockedFile),
+  }).then(common.mustCall());
+  assert.rejects(() => {
+    return new Promise((_resolve, reject) => {
+      const stream = fs.createWriteStream(relativeProtectedFile);
+      stream.on('error', reject);
+    });
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(relativeProtectedFile),
+  }).then(common.mustCall());
+
+  assert.rejects(() => {
+    return new Promise((_resolve, reject) => {
+      const stream = fs.createWriteStream(path.join(blockedFolder, 'example'));
+      stream.on('error', reject);
+    });
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(path.join(blockedFolder, 'example')),
+  }).then(common.mustCall());
+}
+
+// fs.utimes
+{
+  assert.throws(() => {
+    fs.utimes(blockedFile, new Date(), new Date(), () => {});
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(blockedFile),
+  });
+  assert.throws(() => {
+    fs.utimes(bufferBlockedFile, new Date(), new Date(), () => {});
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(blockedFile),
+  });
+  assert.throws(() => {
+    fs.utimes(blockedFileURL, new Date(), new Date(), () => {});
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(blockedFile),
+  });
+  assert.throws(() => {
+    fs.utimes(relativeProtectedFile, new Date(), new Date(), () => {});
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(relativeProtectedFile),
+  });
+
+  assert.throws(() => {
+    fs.utimes(path.join(blockedFolder, 'anyfile'), new Date(), new Date(), () => {});
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(path.join(blockedFolder, 'anyfile')),
+  });
+}
+
+// fs.lutimes
+{
+  assert.throws(() => {
+    fs.lutimes(blockedFile, new Date(), new Date(), () => {});
+  },{
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(blockedFile),
+  });
+  assert.throws(() => {
+    fs.lutimes(bufferBlockedFile, new Date(), new Date(), () => {});
+  },{
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(blockedFile),
+  });
+  assert.throws(() => {
+    fs.lutimes(blockedFileURL, new Date(), new Date(), () => {});
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(blockedFile),
+  });
+}
+
+// fs.mkdir
+{
+  assert.throws(() => {
+    fs.mkdir(path.join(blockedFolder, 'any-folder'), (err) => {
+      assert.ifError(err);
+    });
+  },{
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(path.join(blockedFolder, 'any-folder')),
+  });
+  assert.throws(() => {
+    fs.mkdir(path.join(relativeProtectedFolder, 'any-folder'), (err) => {
+      assert.ifError(err);
+    });
+  },{
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(path.join(relativeProtectedFolder, 'any-folder')),
+  });
+}
+
+{
+  assert.throws(() => {
+    fs.mkdtempSync(path.join(blockedFolder, 'any-folder'));
+  },{
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  });
+  fs.mkdtemp(path.join(relativeProtectedFolder, 'any-folder'), common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  }));
+}
+
+// fs.rename
+{
+  assert.throws(() => {
+    fs.renameSync(blockedFile, path.join(blockedFile, 'renamed'));
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(blockedFile),
+  });
+  fs.rename(blockedFile, path.join(blockedFile, 'renamed'), common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  fs.rename(bufferBlockedFile, path.join(blockedFile, 'renamed'), common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  assert.throws(() => {
+    fs.renameSync(blockedFileURL, path.join(blockedFile, 'renamed'));
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(blockedFile),
+  });
+  assert.throws(() => {
+    fs.renameSync(relativeProtectedFile, path.join(relativeProtectedFile, 'renamed'));
+  },{
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(relativeProtectedFile),
+  });
+  assert.throws(() => {
+    fs.renameSync(blockedFile, path.join(regularFolder, 'renamed'));
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(blockedFile),
+  });
+
+  assert.throws(() => {
+    fs.renameSync(regularFile, path.join(blockedFolder, 'renamed'));
+  },{
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(path.join(blockedFolder, 'renamed')),
+  });
+}
+
+// fs.copyFile
+{
+  assert.throws(() => {
+    fs.copyFileSync(regularFile, path.join(blockedFolder, 'any-file'));
+  },{
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(path.join(blockedFolder, 'any-file')),
+  });
+  assert.throws(() => {
+    fs.copyFileSync(regularFile, path.join(relativeProtectedFolder, 'any-file'));
+  },{
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(path.join(relativeProtectedFolder, 'any-file')),
+  });
+  fs.copyFile(regularFile, path.join(relativeProtectedFolder, 'any-file'), common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(path.join(relativeProtectedFolder, 'any-file')),
+  }));
+  fs.copyFile(bufferBlockedFile, path.join(relativeProtectedFolder, 'any-file'), common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(path.join(relativeProtectedFolder, 'any-file')),
+  }));
+}
+
+// fs.cp
+{
+  assert.throws(() => {
+    fs.cpSync(regularFile, path.join(blockedFolder, 'any-file'));
+  },{
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(path.join(blockedFolder, 'any-file')),
+  });
+  assert.throws(() => {
+    fs.cpSync(regularFile, path.join(relativeProtectedFolder, 'any-file'));
+  },{
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(path.join(relativeProtectedFolder, 'any-file')),
+  });
+}
+
+// fs.rm
+{
+  assert.throws(() => {
+    fs.rmSync(blockedFolder, { recursive: true });
+  },{
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(blockedFolder),
+  });
+  assert.throws(() => {
+    fs.rmSync(relativeProtectedFolder, { recursive: true });
+  },{
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(relativeProtectedFolder),
+  });
+}
+
+// fs.open
+{
+  // Extra flags should not enable trivially bypassing all restrictions.
+  // See https://github.com/nodejs/node/issues/47090.
+  fs.open(blockedFile, fs.constants.O_RDWR | 0x10000000, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  }));
+  fs.open(blockedFileURL, fs.constants.O_RDWR | 0x10000000, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  }));
+  fs.open(bufferBlockedFile, fs.constants.O_RDWR | 0x10000000, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  }));
+  assert.rejects(async () => {
+    await fs.promises.open(blockedFile, fs.constants.O_RDWR | fs.constants.O_NOFOLLOW);
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  });
+  if (common.isWindows) {
+    // In particular, on Windows, the permission system should not blindly let
+    // code delete write-protected files.
+    const O_TEMPORARY = 0x40;
+    assert.throws(() => {
+      fs.openSync(blockedFile, fs.constants.O_RDONLY | O_TEMPORARY);
+    }, {
+      code: 'ERR_ACCESS_DENIED',
+      permission: 'FileSystemWrite'
+    });
+  }
+}
+
+// fs.chmod
+{
+  assert.throws(() => {
+    fs.chmod(blockedFile, 0o755, common.mustNotCall());
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  });
+  assert.throws(() => {
+    fs.chmod(bufferBlockedFile, 0o755, common.mustNotCall());
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  });
+  assert.throws(() => {
+    fs.chmod(blockedFileURL, 0o755, common.mustNotCall());
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  });
+  assert.rejects(async () => {
+    await fs.promises.chmod(blockedFile, 0o755);
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  });
+}
+
+// fs.lchmod
+{
+  if (common.isMacOS) {
+    fs.lchmod(blockedFile, 0o755, common.expectsError({
+      code: 'ERR_ACCESS_DENIED',
+      permission: 'FileSystemWrite',
+    }));
+    assert.rejects(async () => {
+      await fs.promises.lchmod(blockedFile, 0o755);
+    }, {
+      code: 'ERR_ACCESS_DENIED',
+      permission: 'FileSystemWrite',
+    });
+  }
+}
+
+// fs.appendFile
+{
+  fs.appendFile(blockedFile, 'new data', common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  }));
+  fs.appendFile(bufferBlockedFile, 'new data', common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  }));
+  assert.throws(() => {
+    fs.appendFileSync(blockedFileURL, 'new data');
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  });
+  assert.rejects(async () => {
+    await fs.promises.appendFile(blockedFile, 'new data');
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  });
+}
+
+// fs.chown
+{
+  fs.chown(blockedFile, 1541, 999, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  }));
+  fs.chown(bufferBlockedFile, 1541, 999, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  }));
+  assert.throws(() => {
+    fs.chownSync(blockedFileURL, 1541, 999);
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  });
+  // TODO(@RafaelGSS): Uncaught Exception somehow?
+  // assert.rejects(async () => {
+  //   return fs.promises.chown(blockedFile, 1541, 999);
+  // }, {
+  //   code: 'ERR_ACCESS_DENIED',
+  //   permission: 'FileSystemWrite',
+  // });
+}
+
+// fs.lchown
+{
+  fs.lchown(blockedFile, 1541, 999, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  }));
+  fs.lchown(bufferBlockedFile, 1541, 999, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  }));
+  assert.throws(() => {
+    fs.lchownSync(blockedFileURL, 1541, 999);
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  });
+  // TODO(@RafaelGSS): Uncaught Exception somehow?
+  // assert.rejects(async () => {
+  //   await fs.promises.lchown(blockedFile, 1541, 999);
+  // }, {
+  //   code: 'ERR_ACCESS_DENIED',
+  //   permission: 'FileSystemWrite',
+  // });
+}
+
+// fs.link
+{
+  assert.throws(() => {
+    fs.linkSync(blockedFile, path.join(blockedFolder, '/linked'));
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  });
+  fs.link(blockedFile, path.join(blockedFolder, '/linked'), common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  }));
+  fs.link(bufferBlockedFile, path.join(blockedFolder, '/linked'), common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  }));
+  assert.throws(() => {
+    fs.linkSync(blockedFileURL, path.join(blockedFolder, '/linked'));
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  });
+  // TODO(@RafaelGSS): Uncaught Exception somehow?
+  // assert.rejects(async () => {
+  //   await fs.promises.link(blockedFile, path.join(blockedFolder, '/linked'));
+  // }, {
+  //   code: 'ERR_ACCESS_DENIED',
+  //   permission: 'FileSystemWrite',
+  // });
+}
+
+// fs.unlink
+{
+  assert.throws(() => {
+    fs.unlinkSync(blockedFile);
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(blockedFile),
+  });
+  assert.throws(() => {
+    fs.unlinkSync(bufferBlockedFile);
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(blockedFile),
+  });
+  fs.unlink(blockedFile, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(blockedFile),
+  }));
+  assert.throws(() => {
+    fs.unlinkSync(blockedFileURL);
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+    resource: path.toNamespacedPath(blockedFile),
+  });
+}
+
+// fs.fchown with read-only fd
+{
+  assert.throws(() => {
+    // blocked file is allowed to read
+    const fd = fs.openSync(blockedFile, 'r');
+    fs.fchmod(fd, 777, common.expectsError({
+      code: 'ERR_ACCESS_DENIED',
+    }));
+    fs.fchmodSync(fd, 777);
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+  });
+}
+
+// fs.fchmod with read-only fd
+{
+  assert.throws(() => {
+    // blocked file is allowed to read
+    const fd = fs.openSync(blockedFile, 'r');
+    fs.fchown(fd, 999, 999, common.expectsError({
+      code: 'ERR_ACCESS_DENIED',
+    }));
+    fs.fchownSync(fd, 999, 999);
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+  });
+}

test/fixtures/permission/hello-world.js

@@ -0,0 +1 @@
+console.log('Hello world')

test/fixtures/permission/inspector-brk.js

@@ -0,0 +1 @@
+console.log("Hi!")

test/fixtures/permission/loader/index.js

@@ -0,0 +1,3 @@
+const fs = require('node:fs');
+
+fs.readFileSync('/etc/passwd');

test/fixtures/permission/main-module.js

@@ -0,0 +1 @@
+require('./required-module');

test/fixtures/permission/main-module.mjs

@@ -0,0 +1 @@
+import './required-module.mjs';

test/fixtures/permission/processbinding.js

@@ -0,0 +1,24 @@
+const common = require('../../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+const assert = require('assert');
+
+{
+  assert.throws(() => {
+    process.binding();
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+  }));
+}
+
+{
+  assert.throws(() => {
+    process.binding('fs');
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+  }));
+}

test/fixtures/permission/required-module.js

@@ -0,0 +1 @@
+console.log('ok');

test/fixtures/permission/required-module.mjs

@@ -0,0 +1 @@
+console.log('ok');

test/fixtures/permission/simple-loader.js

@@ -0,0 +1,3 @@
+// Simulate a regular loading without fs operations
+// but with access to Node core modules
+require('node:fs')