diff --git a/lib/fs.js b/lib/fs.js index cd9c519c10b23c..6808da39bfc65e 100644 --- a/lib/fs.js +++ b/lib/fs.js @@ -1873,6 +1873,11 @@ function fchmod(fd, mode, callback) { mode = parseFileMode(mode, 'mode'); callback = makeCallback(callback); + if (permission.isEnabled()) { + callback(new ERR_ACCESS_DENIED('fchmod API is disabled when Permission Model is enabled.')); + return; + } + const req = new FSReqCallback(); req.oncomplete = callback; binding.fchmod(fd, mode, req); @@ -1885,6 +1890,9 @@ function fchmod(fd, mode, callback) { * @returns {void} */ function fchmodSync(fd, mode) { + if (permission.isEnabled()) { + throw new ERR_ACCESS_DENIED('fchmod API is disabled when Permission Model is enabled.'); + } binding.fchmod( fd, parseFileMode(mode, 'mode'), @@ -2010,6 +2018,10 @@ function fchown(fd, uid, gid, callback) { validateInteger(uid, 'uid', -1, kMaxUserId); validateInteger(gid, 'gid', -1, kMaxUserId); callback = makeCallback(callback); + if (permission.isEnabled()) { + callback(new ERR_ACCESS_DENIED('fchown API is disabled when Permission Model is enabled.')); + return; + } const req = new FSReqCallback(); req.oncomplete = callback; @@ -2026,6 +2038,9 @@ function fchown(fd, uid, gid, callback) { function fchownSync(fd, uid, gid) { validateInteger(uid, 'uid', -1, kMaxUserId); validateInteger(gid, 'gid', -1, kMaxUserId); + if (permission.isEnabled()) { + throw new ERR_ACCESS_DENIED('fchown API is disabled when Permission Model is enabled.'); + } binding.fchown(fd, uid, gid); } diff --git a/test/fixtures/permission/fs-write.js b/test/fixtures/permission/fs-write.js index a1f26df2c892ab..3afbdb4fbbf197 100644 --- a/test/fixtures/permission/fs-write.js +++ b/test/fixtures/permission/fs-write.js @@ -462,4 +462,32 @@ const relativeProtectedFolder = process.env.RELATIVEBLOCKEDFOLDER; permission: 'FileSystemWrite', resource: path.toNamespacedPath(blockedFile), }); +} + +// fs.fchown with read-only fd +{ + assert.throws(() => { + // blocked file is allowed to read + const fd = fs.openSync(blockedFile, 'r'); + fs.fchmod(fd, 777, common.expectsError({ + code: 'ERR_ACCESS_DENIED', + })); + fs.fchmodSync(fd, 777); + }, { + code: 'ERR_ACCESS_DENIED', + }); +} + +// fs.fchmod with read-only fd +{ + assert.throws(() => { + // blocked file is allowed to read + const fd = fs.openSync(blockedFile, 'r'); + fs.fchown(fd, 999, 999, common.expectsError({ + code: 'ERR_ACCESS_DENIED', + })); + fs.fchownSync(fd, 999, 999); + }, { + code: 'ERR_ACCESS_DENIED', + }); } \ No newline at end of file