Overlap with single-executable effort

[bmeck]

Per https://github.com/nodejs/security-wg/blob/main/meetings/2023-02-16.md , there is some form of potential overlap where a Windows OS integration might need to add a section to the binary to force certain flags to be always enabled and unable to be disabled, just posting this as a cross reference issue for @nodejs/single-executable .

[RaisinTen]

to force certain flags

By that do we mean having a way to hard code a value for the --experimental-policy and --policy-integrity=sri CLI options into the binary?

[bmeck]

@RaisinTen not just those flags, they would need to add another couple flags most likely to enforce policy manifest lookups include a side-car signature file.

[RaisinTen]

Okay, it should be possible to make a change to Node.js to read the CLI options from an injected resource on PE files on Windows and process that during startup. I imagine the implementation would have things in common with nodejs/node#45038 which adds initial support for single executable applications. The injection part could be handled by any tool that is capable of adding resources to PE files like resource hacker, postject, LIEF, rcedit, etc.

[bmeck]

@RaisinTen great, I can make a PR to mandate needing to have a policy to run and then look at that. CC: @nodejs/loaders I believe this might be a little bit relevant but not directly overlap the effort around having a standardized way of automatically configuring loaders.

[github-actions]

This issue is stale because it has been open many days with no activity. It will be closed soon unless the stale label is removed or a comment is made.

[RafaelGSS]

Do we have any update on this?

[bmeck]

single executable apps (SEA) need to figure out how to sign flags or security wg would need to. Right now SEA cannot sign any security flags in a way that will error if they are changed

[RafaelGSS]

Alright, this can be a good initiative for next quarter. Adding to the agenda for awareness. Is there any PR/Issue we can get more information about it?

[RaisinTen]

The discussion in nodejs/single-executable#72 led to this conclusion, so you'll find more information there.