src: add WDAC integration (Windows) #54364

rdw-msft · 2024-08-14T00:35:14Z

Add calls to Windows Defender Application Control to enforce integrity of .js, .json, .node files.

Motivation

In the past I've spoken to @RafaelGSS and the Node security work group about code integrity. We feel like it's an important defense in depth feature and the removal of the --experimental-policy feature gives us room to use OS-level code integrity features. This is a first pass at a CI implementation that cooperates with the OS.

These additions add an additional layer of defense against malicious code execution on a system that is enforcing code integrity. Code Integrity enforcement mitigates the risk of malicious code modifications after signing-time. For example, they can prevent an arbitrary file-write vulnerability from turning into an RCE. These additional checks are only made if the OS in code integrity enforcement mode and has explicitly set a configuration value in their code integrity policy to have Node enforce CI.

Windows Defender Application Control (WDAC)

Official documentation: https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/wdac-and-applocker-overview

WDAC is the Windows code integrity subsystem. It enforces code integrity using digital signatures. This is straightforward for DLLs and EXEs, since they're loaded using well known entry points in the OS. However, dynamic runtimes (interpreters like Node.js or Python) make it difficult to determine whether a file being read will be executed. In order to assist dynamic runtimes, WDAC provides an interface for runtimes to call with the code they intent to execute, and WDAC will determine if the runtime is allowed to execute the code based off signature information. WDAC (wldp.dll) exposes various methods for runtimes to ask the OS questions about the code integrity policy on the system. These changes leverage three interfaces WldpCanExecuteFile, WldpGetApplicationSettingBoolean, and WldpQuerySecurityPolicy.

WldpCanExecuteFile - given a file handle, determines if the file is allowed to be executed from WDAC policy.

WldpGetApplicationSettingBoolean - Queries WDAC policy for an application-defined setting with a boolean value. This can be thought of as a more secure setting store.

WldpQuerySecurityPolicy - WdlpGetApplicationSettingBoolean is not available on all versions of Windows, so this method provides fallback behavior to query WDAC policy settings.

High-level implementation

At startup, Node will query WDAC policy to see if it should enter integrity enforcement mode. If the policy provider Node.js has set the policy setting EnforceCodeIntegrity to TRUE, then Node will call WldpCanExecuteFile when a .js, .json, or .node file is loaded using require. If this setting is not enabled, the call to WldpCanExecuteFile will not be made and execution will continue as normal.

Additionally, if EnforceCodeIntegrity is set to TRUE, we disable features that allow arbitrary code from being executed by Node (e.g. the "-e" command line option and the REPL) when the system is enforcing code integrity.

Signing files

Signatures are stored in catalog file, .cat. This catalog file can be thought of as a collection of filenames and their associated hashes. A Node application author can generate a catalog using the Powershell command New-FileCatalog documentation.

PS> New-FileCatalog -CatalogFilePath ./MyApplicationCatalog.cat -Path ./MyApplicationRelease/

The catalog then can be signed with a certificate trusted by WDAC policy using Powershell with Set-AuthenticodeSignature documentation or signtool.exe

The signed catalog can then be installed on the system MyApplication is being deployed to.

Codecov Report

Attention: Patch coverage is 89.10891% with 11 lines in your changes missing coverage. Please review.

Project coverage is 89.11%. Comparing base (85f5a6c) to head (b349c25).
Report is 11 commits behind head on main.

Files with missing lines	Patch %	Lines
lib/internal/code_integrity.js	86.95%	9 Missing ⚠️
lib/internal/main/eval_string.js	90.90%	1 Missing ⚠️
lib/internal/modules/cjs/loader.js	94.11%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff            @@
##             main   #54364    +/-   ##
========================================
  Coverage   89.11%   89.11%            
========================================
  Files         665      666     +1     
  Lines      193193   193304   +111     
  Branches    37212    37230    +18     
========================================
+ Hits       172158   172260   +102     
+ Misses      13775    13769     -6     
- Partials     7260     7275    +15

Files with missing lines	Coverage Δ
lib/internal/errors.js	`97.46% <100.00%> (+<0.01%)`	⬆️
src/node_binding.cc	`83.66% <ø> (ø)`
src/node_external_reference.h	`100.00% <ø> (ø)`
lib/internal/main/eval_string.js	`80.89% <90.90%> (+1.41%)`	⬆️
lib/internal/modules/cjs/loader.js	`98.08% <94.11%> (-0.18%)`	⬇️
lib/internal/code_integrity.js	`86.95% <86.95%> (ø)`

... and 27 files with indirect coverage changes

RafaelGSS

We've discussed on the security-wg and the next steps are:

Creating documentation
Improving the test coverage

Then we can go the a proper code review. Meanwhile, I'm tagging @nodejs/tsc for awareness.

This is a Windows specific feature that will enabled by a node key in Windows system dictionary. So, it shouldn't be considered a semver-major or a specific Node.js API.

Currently, Windows should be the only environment that makes those checks available via API. We are still evaluating the status of OSX and Linux support for that. However, it's fair to assume this PR will only implement such guarantees for Windows users.

I recommend watching our meeting as we've discussed the usage and how this is turned-on in Windows systems (https://www.youtube.com/watch?v=w4zzH-otKNI)

l0kod · 2024-09-11T14:24:05Z

FYI, we are working on a similar feature for Linux. The goal is the same but the implementation and API are different. Linux already provides access control systems and this new feature (previously open+O_MAYEXEC, now execveat+AT_CHECK) is the missing piece to control script execution the same way other kind of execution can already be controlled. This article gives a good overview: https://lwn.net/Articles/982085/

I plan to send a new patch series in a few weeks. Please let me know what you think.

l0kod · 2024-09-11T15:33:16Z

Cc @tiran, @zooba

rdw-msft · 2024-10-29T17:30:55Z

Hey @RafaelGSS , I've added more documentation about code integrity mode. Please let me know if it looks adequate, or if you'd like me to explain more.

I also added doc/api/wdac-manifest.xml. This is the manifest we spoke about in the last meeting I attended. It declares the WDAC Application settings that NodeJS will query for. It should be hosted in an accessible place so when system admins author their Windows Code Integrity policy they know what settings are available to them, and it also adds some type-checking for the policy writer.

I'll plan on attending the next security WG meeting to discuss in more detail if needed. Thanks

doc/api/wdac-manifest.xml

jasnell · 2024-11-05T23:28:41Z

doc/api/wdac-manifest.xml

+<AppManifest Id="NodeJS" xmlns="urn:schemas-microsoft-com:windows-defender-application-control">
+  <SettingDefinition Name="EnforceCodeIntegrity" Type="Boolean" IgnoreAuditPolicies="false"/>
+  <SettingDefinition Name="DisableInterpretiveMode" Type="Boolean" IgnoreAuditPolicies="false"/>
+</AppManifest>


Suggested change

</AppManifest>

</AppManifest>

lib/internal/code_integrity.js

jasnell · 2024-11-05T23:33:01Z

src/node_code_integrity.cc

+static void IsFileTrustedBySystemCodeIntegrityPolicy(
+  const FunctionCallbackInfo<Value>& args) {
+    args.GetReturnValue().Set(true);
+}


These could probably just be implemented in JavaScript so avoid the extraneous JS->C++ boundary call.

jasnell · 2024-11-05T23:33:34Z

src/node_code_integrity.h

+
+#include <Windows.h>
+
+// {0xb5367df1,0xcbac,0x11cf,{0x95,0xca,0x00,0x80,0x5f,0x48,0xa1,0x92}}


It's not clear what this comment is.

src/node_code_integrity.h

jasnell · 2024-11-05T23:35:47Z

src/node_code_integrity.h

+#ifndef SRC_NODE_CODE_INTEGRITY_H_
+#define SRC_NODE_CODE_INTEGRITY_H_
+
+#ifdef _WIN32


Given that this is Windows only, I would generally prefer that this entire internal binding only be compiled on windows, with the non-functional stubs implemented solely in javascript on the other platforms.

RafaelGSS

It's missing some tests, for instance, eval (The check you placed inside internal/main/eval_string)
This feature should be opt-in, it can be either behind a flag or behind a compile time flag. To be honest, I'd first add it as a compile time flag, then we promote it to runtime flag.

RafaelGSS · 2025-02-03T13:20:40Z

doc/api/code_integrity.md

+If you find a potential security vulnerability, please refer to our
+[Security Policy][].
+
+## Code Integrity on Windows


Suggested change

## Code Integrity on Windows

## Code Integrity on Windows

RafaelGSS · 2025-02-03T13:40:27Z

doc/api/code_integrity.md

+
+> Stability: 1.1 - Active development
+
+Code integrity refers to the assurance that software code has not been


I think it should be opted-in for - behind a flag - to users. This documentation should first describe what they should do in the terminal such as starting nodejs with --code-integrity then describing nuances of the code integrity.

RafaelGSS · 2025-02-03T13:42:46Z

lib/code_integrity.js

+  isSystemEnforcingCodeIntegrity: () => false,
+};
+// Load the actual binding if on Windows
+if (isWindows) {


Should we also check the Windows version or do all supported Windows platforms have it?

RafaelGSS · 2025-02-03T13:44:47Z

lib/internal/modules/cjs/loader.js

@@ -198,6 +199,8 @@ const onRequire = getLazy(() => tracingChannel('module.require'));

 const relativeResolveCache = { __proto__: null };

+const ci = require('code_integrity');


Yes @rdw-msft. So it won't be exposed as a module to users (unless they pass --expose-internals)

RafaelGSS · 2025-02-03T13:45:35Z

lib/internal/modules/cjs/loader.js

@@ -1909,6 +1918,12 @@ Module._extensions['.js'] = function(module, filename) {
 * @param {string} filename The file path of the module
 */
 Module._extensions['.json'] = function(module, filename) {
+
+  const isAllowedToExecute = ci.isAllowedToExecuteFile(filename);


As I said earlier. It would be better placed inside Module._load so you don't need to replicate it to every extension.

Add calls to Windows Defender Application Control to enforce integrity of .js, .json, .node files.

nodejs-github-bot added lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels Aug 14, 2024

RafaelGSS added semver-minor PRs that contain new features and should be released in the next minor version. security-wg-agenda labels Aug 14, 2024

mcollina reviewed Aug 14, 2024

View reviewed changes

rdw-msft mentioned this pull request Aug 21, 2024

Discuss WDAC (code integrity on Windows) nodejs/security-wg#1364

Open

mhdawson mentioned this pull request Aug 26, 2024

Node.js Security team Meeting 2024-08-29 nodejs/security-wg#1365

Closed

RafaelGSS requested changes Aug 29, 2024

View reviewed changes

mhdawson mentioned this pull request Sep 9, 2024

Node.js Security team Meeting 2024-09-12 nodejs/security-wg#1375

Closed

mhdawson mentioned this pull request Sep 23, 2024

Node.js Security team Meeting 2024-09-26 nodejs/security-wg#1382

Closed

l0kod mentioned this pull request Sep 27, 2024

Script execution control on Linux nodejs/security-wg#1388

Open

mhdawson mentioned this pull request Oct 8, 2024

Node.js Security team Meeting 2024-10-10 nodejs/security-wg#1389

Closed

rdw-msft force-pushed the wldp-integration branch from 7cfafd5 to e8e5e7a Compare October 10, 2024 17:16

rdw-msft force-pushed the wldp-integration branch from e8e5e7a to 18b9645 Compare October 29, 2024 17:26

mhdawson mentioned this pull request Nov 4, 2024

Node.js Security team Meeting 2024-11-07 nodejs/security-wg#1398

Closed

jasnell reviewed Nov 5, 2024

View reviewed changes

doc/api/wdac-manifest.xml Show resolved Hide resolved

jasnell reviewed Nov 5, 2024

View reviewed changes

lib/internal/code_integrity.js Show resolved Hide resolved

jasnell reviewed Nov 5, 2024

View reviewed changes

src/node_code_integrity.h Show resolved Hide resolved

jasnell reviewed Nov 5, 2024

View reviewed changes

mhdawson mentioned this pull request Dec 2, 2024

Node.js Security team Meeting 2024-12-05 nodejs/security-wg#1407

Closed

mhdawson mentioned this pull request Dec 16, 2024

Node.js Security team Meeting 2024-12-19 nodejs/security-wg#1415

Closed

mhdawson mentioned this pull request Dec 30, 2024

Node.js Security team Meeting 2025-01-02 nodejs/security-wg#1418

Closed

mhdawson mentioned this pull request Jan 13, 2025

Node.js Security team Meeting 2025-01-16 nodejs/security-wg#1420

Closed

rdw-msft force-pushed the wldp-integration branch from 8765dc6 to 7560a46 Compare January 23, 2025 17:10

mhdawson mentioned this pull request Jan 27, 2025

Node.js Security team Meeting 2025-01-30 nodejs/security-wg#1431

Closed

RafaelGSS added the windows Issues and PRs related to the Windows platform. label Jan 30, 2025

RafaelGSS requested changes Feb 3, 2025

View reviewed changes

rdw-msft force-pushed the wldp-integration branch from 7560a46 to d4b6249 Compare February 6, 2025 20:22

mhdawson mentioned this pull request Feb 10, 2025

Node.js Security team Meeting 2025-02-13 nodejs/security-wg#1436

Closed

rdw-msft and others added 17 commits February 12, 2025 11:31

src: add WDAC integration (Windows)

b020b96

Add calls to Windows Defender Application Control to enforce integrity of .js, .json, .node files.

appease linter

9201ba7

use LF instead of CRLF

68a2d02

fix expected exception

acedaea

move code_integrity to internal module, fix formatting

d3a82a5

add DisableInteractiveMode code integrity setting

274c1e2

add more code integrity docs

b76a2fa

clarify docs, add active development status

d9ddfc9

move stub calls for Linux/Darwin into js

28f2d04

fix expose internals flag location

ec6fd32

remove trailing whitespace

253e92d

update documentation

dd1cb3b

Fix

c1c101f

move global variables into per_process namespace. fix formatting

ba59792

better docs, formatting

ac903dd

better docs, formatting

36e7520

move integrity check into module._load

ecb293b

rdw-msft force-pushed the wldp-integration branch from d4b6249 to ecb293b Compare February 13, 2025 03:07

rdw-msft added 2 commits February 13, 2025 11:06

fixes for failing linting

163f7d0

run linter on md file

b349c25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

src: add WDAC integration (Windows) #54364

src: add WDAC integration (Windows) #54364

rdw-msft commented Aug 14, 2024

nodejs-github-bot commented Aug 14, 2024

anonrig commented Aug 14, 2024

rdw-msft commented Aug 14, 2024

targos commented Aug 14, 2024

mcollina Aug 14, 2024

rdw-msft Aug 21, 2024

RafaelGSS Feb 3, 2025

codecov bot commented Aug 19, 2024 •

edited

Loading

RafaelGSS left a comment

l0kod commented Sep 11, 2024

l0kod commented Sep 11, 2024

rdw-msft commented Oct 29, 2024

jasnell Nov 5, 2024

jasnell Nov 5, 2024

jasnell Nov 5, 2024

jasnell Nov 5, 2024

RafaelGSS left a comment

RafaelGSS Feb 3, 2025

RafaelGSS Feb 3, 2025

RafaelGSS Feb 3, 2025

RafaelGSS Feb 3, 2025

RafaelGSS Feb 3, 2025

		@@ -198,6 +199,8 @@ const onRequire = getLazy(() => tracingChannel('module.require'));

		const relativeResolveCache = { __proto__: null };

		const ci = require('code_integrity');


		#include <Windows.h>

		// {0xb5367df1,0xcbac,0x11cf,{0x95,0xca,0x00,0x80,0x5f,0x48,0xa1,0x92}}


		> Stability: 1.1 - Active development

		Code integrity refers to the assurance that software code has not been

src: add WDAC integration (Windows) #54364

Are you sure you want to change the base?

src: add WDAC integration (Windows) #54364

Conversation

rdw-msft commented Aug 14, 2024

Motivation

Windows Defender Application Control (WDAC)

High-level implementation

Signing files

Other Questions

nodejs-github-bot commented Aug 14, 2024

anonrig commented Aug 14, 2024

rdw-msft commented Aug 14, 2024

targos commented Aug 14, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codecov bot commented Aug 19, 2024 • edited Loading

Codecov Report

RafaelGSS left a comment

Choose a reason for hiding this comment

l0kod commented Sep 11, 2024

l0kod commented Sep 11, 2024

rdw-msft commented Oct 29, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

RafaelGSS left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codecov bot commented Aug 19, 2024 •

edited

Loading