fix(permissions): disallow launching subprocess with LD_PRELOAD env var without full run permissions (#25221)

Ref https://github.com/denoland/deno/pull/25215

Closes https://github.com/denoland/deno/issues/11964

runtime/ops/process.rs

@@ -229,9 +229,23 @@ fn create_command(
   mut args: SpawnArgs,
   api_name: &str,
 ) -> Result<CreateCommand, AnyError> {
-  state
-    .borrow_mut::<PermissionsContainer>()
-    .check_run(&args.cmd, api_name)?;
+  {
+    let permissions = state.borrow_mut::<PermissionsContainer>();
+    permissions.check_run(&args.cmd, api_name)?;
+    // error the same on all platforms
+    if permissions.check_run_all(api_name).is_err()
+      && (args.env.iter().any(|(k, _)| k.trim() == "LD_PRELOAD")
+        || !args.clear_env
+          && std::env::vars().any(|(k, _)| k.trim() == "LD_PRELOAD"))
+    {
+      // we don't allow users to launch subprocesses with the LD_PRELOAD
+      // env var set because this allows executing any code
+      return Err(deno_core::error::custom_error(
+          "PermissionDenied",
+          "Requires --allow-all permissions to spawn subprocess with LD_PRELOAD environment variable."
+        ));
+    }
+  }
 
   let mut command = std::process::Command::new(args.cmd);
 

tests/specs/run/ld_preload/__test__.jsonc

@@ -0,0 +1,14 @@
+{
+  "tests": {
+    "env_arg": {
+      "args": "run --allow-run=echo env_arg.ts",
+      "output": "env_arg.out",
+      "exitCode": 1
+    },
+    "set_with_allow_env": {
+      "args": "run --allow-run=echo --allow-env set_with_allow_env.ts",
+      "output": "set_with_allow_env.out",
+      "exitCode": 1
+    }
+  }
+}

tests/specs/run/ld_preload/env_arg.out

@@ -0,0 +1,4 @@
+error: Uncaught (in promise) PermissionDenied: Requires --allow-all permissions to spawn subprocess with LD_PRELOAD environment variable.
+}).spawn();
+   ^
+    at [WILDCARD]

tests/specs/run/ld_preload/env_arg.ts

@@ -0,0 +1,5 @@
+const output = new Deno.Command("echo", {
+  env: {
+    "LD_PRELOAD": "./libpreload.so",
+  },
+}).spawn();

tests/specs/run/ld_preload/set_with_allow_env.out

@@ -0,0 +1,4 @@
+error: Uncaught (in promise) PermissionDenied: Requires --allow-all permissions to spawn subprocess with LD_PRELOAD environment variable.
+const output = new Deno.Command("echo").spawn();
+                                        ^
+    at [WILDCARD]

tests/specs/run/ld_preload/set_with_allow_env.ts

@@ -0,0 +1,3 @@
+Deno.env.set("LD_PRELOAD", "./libpreload.so");
+
+const output = new Deno.Command("echo").spawn();