node-seccomp VS LavaMoat

I was exploring the actual implementation[0] of a capabilities feature in Nodejs and was utilising seccomp (via libseccomp) on Linux at least to achieve a greater degree of security than might otherwise be possible by remaining in userland code. The idea is that you'd write your code, import whatever you like and define your capabilities upfront at initialisation. The problem is there's quite a big disconnect between what you are doing in JavaScript and what's happening with system calls in v8, libuv and the other native parts that it's difficult to predict what you need to block and what's actually going to happen. So I don't think my approach is really viable in a general sense, although capabilities in general I think would improve the situation if the wider community were to adopt the approach.

[0]. https://github.com/roryrjb/node-seccomp

Just yesterday I watched a talk [0] at WarsawJS about LavaMoat [1], a set of tools to protect against malicious behaviour from npm dependencies. Guess it’s time to look into it deeper.

[0]: https://naugtur.pl/pres3/lava/2023end.html

[1]: https://github.com/LavaMoat/LavaMoat

You are basically talking about Lavamoat. It provides tooling and policies for SES, which aims to make it into standards.

https://github.com/LavaMoat/LavaMoat

Enter: lavamoat. https://github.com/LavaMoat/LavaMoat

You should check out Lavamoat: https://github.com/LavaMoat/LavaMoat

It attempts to do what you're essentially describing. It was built by the MetaMask team, where supply chain attacks are an obviously huge risk.

I've spent some time trying to get it working in an app, but haven't been able to get it all the way working. It's still pretty beta and not well documented.

And it is happening right now. Github is opening the GitHub Advisory Database to community submissions. Awesome community NodeSecure builds cool things like scanner and js-x-ray. There are also lockfile-lint, LavaMoat, Jfrog-npm-tools (and I am sure there is more).

There is a proposal to add OCAPs on a language level in TC39[0]. There is already a drop-in implementation which already works in both Nodejs and browsers[1].

As a developer who wants to sandbox your own (recursive) dependencies, this is made accessible today in Lavamoat[2]. Basically a package or app can provide a policy manifest specifying which capabilities (e.g. network or filesystem access) should be granted for each dependency. Also comes with a tool that will auto-generate a starting point from your existing dependency tree.

IMO this is the future. Currently it does come with a performance penalty but hopefully this idea will catch on and make it into runtime implementations.

Lavamoat is still marked as "preprod" on npm but talking to the author it's a matter of days or weeks until the first stable release.

[0]: https://news.ycombinator.com/item?id=30703817

[1]: https://github.com/endojs/endo/tree/master/packages/ses

[2]: https://github.com/LavaMoat/LavaMoat