permission: clamp worker grants to parent when execArgv is set

Address review feedback on the previous JS approach:

- Remove any userland execArgv copying (incomplete: NODE_OPTIONS,
  repeated allow flags, false sense of inheritance).
- After Worker option parse in node_worker.cc, if the parent has the
  Permission Model enabled, intersect permission-related grants so the
  worker cannot exceed the parent (boolean allows AND path allowlists).
- Non-permission execArgv differences remain possible.

This may be semver-major relative to treating worker permission
non-inheritance as permanent API surface; flagged for reviewer judgment.

Signed-off-by: yunshingng <yunshingng25@gmail.com>

Author: yunshingng

src/node_worker.cc

@@ -504,6 +504,71 @@ Worker::~Worker() {
   Debug(this, "Worker %llu destroyed", thread_id_.id);
 }
 
+
+// When the parent runs with the Permission Model enabled, an explicit Worker
+// execArgv (including []) must not yield a wider grant set than the parent.
+// Non-permission CLI differences remain allowed; only permission-related
+// options are intersected with the parent after parse.
+static bool PathAllowedByParent(const std::vector<std::string>& parent_paths,
+                                const std::string& child) {
+  if (parent_paths.empty()) {
+    return false;
+  }
+  for (const std::string& p : parent_paths) {
+    if (p == "*" || p == child) {
+      return true;
+    }
+    if (!p.empty() && child.size() >= p.size() &&
+        child.compare(0, p.size(), p) == 0) {
+      return true;
+    }
+  }
+  return false;
+}
+
+static void IntersectPathList(std::vector<std::string>* worker,
+                              const std::vector<std::string>& parent) {
+  if (worker->empty()) {
+    return;
+  }
+  std::vector<std::string> out;
+  for (const std::string& w : *worker) {
+    if (PathAllowedByParent(parent, w)) {
+      out.push_back(w);
+    }
+  }
+  *worker = std::move(out);
+}
+
+static void ClampWorkerPermissionToParent(Environment* env,
+                                          PerIsolateOptions* worker_opts) {
+  if (!env->permission()->enabled() || worker_opts == nullptr) {
+    return;
+  }
+
+  EnvironmentOptions* parent =
+      env->isolate_data()->options()->get_per_env_options();
+  EnvironmentOptions* w = worker_opts->get_per_env_options();
+
+  // Parent is under the Permission Model → worker stays under it.
+  w->permission = true;
+
+  w->allow_addons = w->allow_addons && parent->allow_addons;
+  w->allow_inspector = w->allow_inspector && parent->allow_inspector;
+  w->allow_child_process =
+      w->allow_child_process && parent->allow_child_process;
+  w->allow_net = w->allow_net && parent->allow_net;
+  w->allow_wasi = w->allow_wasi && parent->allow_wasi;
+  w->allow_ffi = w->allow_ffi && parent->allow_ffi;
+  w->allow_openssl_store =
+      w->allow_openssl_store && parent->allow_openssl_store;
+  w->allow_worker_threads =
+      w->allow_worker_threads && parent->allow_worker_threads;
+
+  IntersectPathList(&w->allow_fs_read, parent->allow_fs_read);
+  IntersectPathList(&w->allow_fs_write, parent->allow_fs_write);
+}
+
 void Worker::New(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   THROW_IF_INSUFFICIENT_PERMISSIONS(
@@ -688,6 +753,11 @@ void Worker::New(const FunctionCallbackInfo<Value>& args) {
   // essential to load user codes and must not be blocked by the inspector
   // for internal scripts.
   // Still, `--inspect-node` can break on the first line of internal scripts.
+
+  if (env->permission()->enabled() && per_isolate_opts) {
+    ClampWorkerPermissionToParent(env, per_isolate_opts.get());
+  }
+
   if (is_internal) {
     per_isolate_opts->per_env->get_debug_options()
         ->DisableWaitOrBreakFirstLine();

test/parallel/test-permission-worker-empty-execargv.js

@@ -0,0 +1,80 @@
+'use strict';
+
+// Under --permission, explicit Worker execArgv (including []) must not produce
+// a wider grant set than the parent (C++ clamp / intersection).
+
+const common = require('../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+
+const allowed = tmpdir.path;
+const deniedFile = path.join(tmpdir.path, '..', 'permission-worker-denied-file');
+fs.writeFileSync(deniedFile, 'secret\n');
+
+const workerSource = `
+  const { parentPort } = require('worker_threads');
+  const fs = require('fs');
+  const denied = ${JSON.stringify(deniedFile)};
+  let result;
+  try {
+    result = { ok: true, data: fs.readFileSync(denied, 'utf8') };
+  } catch (err) {
+    result = { ok: false, code: err.code, message: err.message };
+  }
+  parentPort.postMessage(result);
+`;
+
+function runCase(label, useEmptyExecArgv) {
+  const execArgvLine = useEmptyExecArgv ? 'execArgv: [],' : '';
+  const code = `
+    const { Worker } = require('worker_threads');
+    const w = new Worker(${JSON.stringify(workerSource)}, {
+      eval: true,
+      ${execArgvLine}
+    });
+    w.on('message', (msg) => {
+      process.stdout.write(JSON.stringify({ label: ${JSON.stringify(label)}, msg }) + '\\n');
+      process.exit(0);
+    });
+    w.on('error', (err) => {
+      console.error(err);
+      process.exit(1);
+    });
+  `;
+  return spawnSync(
+    process.execPath,
+    [
+      '--permission',
+      `--allow-fs-read=${allowed}`,
+      '--allow-worker',
+      '-e',
+      code,
+    ],
+    { encoding: 'utf8', timeout: 15000 },
+  );
+}
+
+const defaultWorker = runCase('default', false);
+const emptyExecArgv = runCase('empty-execArgv', true);
+
+assert.strictEqual(defaultWorker.status, 0, defaultWorker.stderr);
+assert.strictEqual(emptyExecArgv.status, 0, emptyExecArgv.stderr);
+
+const defaultMsg = JSON.parse(defaultWorker.stdout.trim().split('\n').pop());
+const emptyMsg = JSON.parse(emptyExecArgv.stdout.trim().split('\n').pop());
+
+assert.strictEqual(defaultMsg.msg.ok, false, JSON.stringify(defaultMsg));
+assert.strictEqual(defaultMsg.msg.code, 'ERR_ACCESS_DENIED');
+assert.strictEqual(emptyMsg.msg.ok, false, JSON.stringify(emptyMsg));
+assert.strictEqual(emptyMsg.msg.code, 'ERR_ACCESS_DENIED');