process.permission

This API is available through the --permission or --permission-audit flags.

process.permission is an object whose methods are used to manage permissions for the current process. Additional documentation is available in the Permission Model.

process.permission.has(scope, reference?): boolean

Verifies that the process is able to access the given scope and reference. If no reference is provided, a global scope is assumed, for instance, process.permission.has('fs.read') will check if the process has ALL file system read permissions.

In audit mode (--permission-audit), this method still returns the actual permission status, but denied operations will not throw ERR_ACCESS_DENIED.

The reference has a meaning based on the provided scope. For example, the reference when the scope is File System means files and folders.

The available scopes are:

• fs - All File System
• fs.read - File System read operations
• fs.write - File System write operations
• child - Child process spawning operations
• openssl.store - Loading keys through OpenSSL STORE loaders
• worker - Worker thread spawning operation
• ffi - Foreign function interface operations

// Check if the process has permission to read the README file
process.permission.has('fs.read', './README.md');
// Check if the process has read permission operations
process.permission.has('fs.read');

process.permission.drop(scope, reference?): void

Drops the specified permission from the current process. This operation is irreversible — once a permission is dropped, it cannot be restored through any Node.js API.

In audit mode (--permission-audit), dropping a permission takes effect, but since denied operations do not throw, the impact is limited to changing the return value of permission.has().

If no reference is provided, the entire scope is dropped. For example, process.permission.drop('fs.read') will revoke ALL file system read permissions.

When a reference is provided, only the permission for that specific resource is dropped. For example, process.permission.drop('fs.read', '/etc/myapp') will revoke read access to that directory while keeping other read permissions intact.

Important: You can only drop the exact resource that was explicitly granted. The reference passed to drop() must match the original grant:

• If a permission was granted using a wildcard (*), such as --allow-fs-read=*, individual paths cannot be dropped - only the entire scope can be dropped (by calling drop() without a reference).
• If a directory was granted (e.g. --allow-fs-read=/my/folder), you cannot drop access to individual files inside it. You must drop the same directory that was granted. Any remaining grants continue to apply.

The available scopes are the same as process.permission.has():

• fs - All File System (drops both read and write)
• fs.read - File System read operations
• fs.write - File System write operations
• child - Child process spawning operations
• openssl.store - Loading keys through OpenSSL STORE loaders
• worker - Worker thread spawning operation
• net - Network operations
• inspector - Inspector operations
• wasi - WASI operations
• addon - Native addon operations

const fs = require('node:fs');

// Read configuration during startup
const config = fs.readFileSync('/etc/myapp/config.json', 'utf8');

// Drop read access to the config directory after initialization
process.permission.drop('fs.read', '/etc/myapp');

// This will now throw ERR_ACCESS_DENIED
fs.readFileSync('/etc/myapp/config.json');