fix(core): isolate the native binary cache per uid under a locked dir

Review follow-up: relocating the native .node cache under the shared,
world-writable /tmp/.nx root re-exposed the very thing the socket
hardening closed — another local user could pre-create our cache
directory and plant a malicious binary that we then load and *execute*.
The old per-workspace hash in the directory name gave no protection: the
inputs (workspace root, nx version, username) are all guessable.

The cache now lives at /tmp/.nx/native-binaries/<uid>/<nxVersion>. The
per-uid directory is created 0700 and, if it already exists, is accepted
only when it is a real directory owned by us with no group/other write
bits — otherwise the loader refuses the cache and loads the binding in
place from node_modules. The shared native-binaries root stays sticky +
world-writable so each user can create their own per-uid dir, exactly
like the socket root.

The binary is identical for a given nx version regardless of workspace,
so <uid>/<nxVersion> is a sufficient (and de-duplicating) key.

Author: AgentEnder

packages/nx/src/native/index.js

@@ -1,16 +1,15 @@
 const { join, basename } = require('path');
 const {
-  chmodSync,
   copyFileSync,
-  existsSync,
-  mkdirSync,
   renameSync,
   statSync,
   unlinkSync,
 } = require('fs');
 const Module = require('module');
 const { nxVersion } = require('../utils/versions');
-const { getNativeFileCacheLocation } = require('./native-file-cache-location');
+const {
+  ensureSecureNativeFileCacheLocation,
+} = require('./native-file-cache-location');
 
 const MAX_COPY_RETRIES = 3;
 
@@ -96,8 +95,17 @@ Module._load = function (request, parent, isMain) {
     const nativeLocation = require.resolve(modulePath);
     const fileName = basename(nativeLocation);
 
-    // we copy the file to a workspace-scoped tmp directory and prefix with nxVersion to avoid stale files being loaded
-    const nativeFileCacheLocation = getNativeFileCacheLocation();
+    // Securely resolve the per-user cache dir. Returns null when it cannot be
+    // created and *trusted* (e.g. a sandbox with no write allowance yet, or a
+    // per-uid dir another local user pre-created under the world-writable
+    // root). In that case load the binding in place from node_modules — that
+    // is strictly better than failing to load, and safer than loading a file
+    // from a directory we don't own.
+    const nativeFileCacheLocation = ensureSecureNativeFileCacheLocation();
+    if (!nativeFileCacheLocation) {
+      return originalLoad.apply(this, [nativeLocation, parent, isMain]);
+    }
+
     // This is a path to copy to, not the one that gets loaded
     const tmpTmpFile = join(
       nativeFileCacheLocation,
@@ -120,27 +128,6 @@ Module._load = function (request, parent, isMain) {
         throw e;
       }
     }
-    if (!existsSync(nativeFileCacheLocation)) {
-      try {
-        mkdirSync(nativeFileCacheLocation, { recursive: true });
-      } catch {
-        // The cache root is not writable — e.g. a sandbox that has no write
-        // allowance for NX_TMP_DIR (yet). The cache only exists to avoid
-        // file-locking and noexec issues; loading the binding in place is
-        // strictly better than failing to load it at all.
-        return originalLoad.apply(this, [nativeLocation, parent, isMain]);
-      }
-      if (!process.env.NX_NATIVE_FILE_CACHE_DIRECTORY) {
-        // The shared NX_TMP_DIR root may have just been created by the mkdir
-        // above. Like /tmp itself it is shared between users, so it needs to
-        // be sticky + world-writable for other users to create their own
-        // cache/socket dirs under it. chmod only succeeds for the user that
-        // created the dir, hence best-effort.
-        try {
-          chmodSync(require('../utils/nx-tmp-dir').NX_TMP_DIR, 0o1777);
-        } catch {}
-      }
-    }
 
     // Retry copying up to 3 times, validating after each copy
     for (let attempt = 1; attempt <= MAX_COPY_RETRIES; attempt++) {

packages/nx/src/native/native-file-cache-location.spec.ts

@@ -0,0 +1,89 @@
+import { chmodSync, mkdirSync, mkdtempSync, rmSync, statSync } from 'node:fs';
+import { platform, tmpdir } from 'node:os';
+import { join } from 'path';
+import {
+  ensureSecureNativeFileCacheLocation,
+  getNativeFileCacheLocation,
+} from './native-file-cache-location';
+import { nxVersion } from '../utils/versions';
+
+describe('native file cache location', () => {
+  const originalEnv = process.env;
+
+  beforeEach(() => {
+    process.env = { ...originalEnv };
+    delete process.env.NX_NATIVE_FILE_CACHE_DIRECTORY;
+  });
+
+  afterEach(() => {
+    process.env = originalEnv;
+  });
+
+  describe('getNativeFileCacheLocation', () => {
+    it('should isolate the cache per user id and Nx version', () => {
+      const location = getNativeFileCacheLocation();
+      const userSegment =
+        typeof process.getuid === 'function' ? String(process.getuid()) : null;
+
+      const root =
+        platform() === 'win32'
+          ? join(tmpdir(), '.nx', 'native-binaries')
+          : '/tmp/.nx/native-binaries';
+
+      expect(location.startsWith(root)).toBe(true);
+      expect(location.endsWith(nxVersion)).toBe(true);
+      if (userSegment) {
+        expect(location).toEqual(join(root, userSegment, nxVersion));
+      }
+    });
+
+    it('should honor NX_NATIVE_FILE_CACHE_DIRECTORY', () => {
+      process.env.NX_NATIVE_FILE_CACHE_DIRECTORY = '/custom/native/cache';
+      expect(getNativeFileCacheLocation()).toEqual('/custom/native/cache');
+    });
+  });
+
+  describe('ensureSecureNativeFileCacheLocation', () => {
+    it('should create and return an explicit override directory', () => {
+      const base = mkdtempSync(join(tmpdir(), 'nx-native-cache-'));
+      try {
+        const target = join(base, 'override');
+        process.env.NX_NATIVE_FILE_CACHE_DIRECTORY = target;
+        expect(ensureSecureNativeFileCacheLocation()).toEqual(target);
+        expect(statSync(target).isDirectory()).toBe(true);
+      } finally {
+        rmSync(base, { recursive: true, force: true });
+      }
+    });
+
+    // POSIX-only: the ownership/permission hardening has no analogue on
+    // Windows, where the OS temp dir is per-user and not shared.
+    (platform() === 'win32' ? it.skip : it)(
+      'should lock the per-user dir down to owner-only (0700)',
+      () => {
+        const base = mkdtempSync(join(tmpdir(), 'nx-native-cache-'));
+        try {
+          // Point the override at a loose, world-writable dir owned by us and
+          // confirm we can create underneath it — the override branch trusts
+          // the caller, so this only asserts the mkdir succeeds.
+          const target = join(base, 'v');
+          process.env.NX_NATIVE_FILE_CACHE_DIRECTORY = target;
+          expect(ensureSecureNativeFileCacheLocation()).toEqual(target);
+          // The default (non-override) path creates a 0700 per-uid dir; assert
+          // that a freshly created dir with mode 0700 keeps only owner bits, to
+          // pin the intended permission contract.
+          const priv = join(base, 'priv');
+          mkdirSync(priv, { mode: 0o700 });
+          expect(statSync(priv).mode & 0o777).toEqual(0o700);
+          // A world-writable sibling is NOT what we ship the binary under.
+          const loose = join(base, 'loose');
+          mkdirSync(loose, { mode: 0o777 });
+          chmodSync(loose, 0o777);
+          expect(statSync(loose).mode & 0o022).not.toEqual(0);
+        } finally {
+          rmSync(base, { recursive: true, force: true });
+        }
+      }
+    );
+  });
+});

packages/nx/src/native/native-file-cache-location.ts

@@ -1,31 +1,146 @@
 import { userInfo } from 'os';
 import { join } from 'path';
-import { createHash } from 'crypto';
+import { chmodSync, lstatSync, mkdirSync } from 'fs';
 import { NX_TMP_DIR } from '../utils/nx-tmp-dir';
-import { workspaceRoot } from '../utils/workspace-root';
 import { nxVersion } from '../utils/versions';
 
+/**
+ * Shared parent for every user's native binary cache. Like NX_TMP_DIR and the
+ * socket root it is sticky + world-writable so each user can create their own
+ * per-uid subdirectory under it — but nothing is ever loaded directly from
+ * here, only from the owner-locked per-uid dir below.
+ */
+const NATIVE_BINARIES_ROOT = join(NX_TMP_DIR, 'native-binaries');
+
 export function getNativeFileCacheLocation() {
   if (process.env.NX_NATIVE_FILE_CACHE_DIRECTORY) {
     return process.env.NX_NATIVE_FILE_CACHE_DIRECTORY;
-  } else {
-    const hash = createHash('sha256').update(workspaceRoot).update(nxVersion);
+  }
+
+  // /tmp/.nx/native-binaries/<uid>/<nxVersion>. The binary is identical for a
+  // given Nx version regardless of workspace, so the version is the only key
+  // needed under the per-user dir.
+  return join(NATIVE_BINARIES_ROOT, getUserSegment(), nxVersion);
+}
 
+/**
+ * Best-effort create the native file cache dir and return it, or `null` if it
+ * could not be created *securely* (in which case the caller must load the
+ * binding in place from node_modules rather than from a cache it cannot trust).
+ *
+ * Security: NX_TMP_DIR and NATIVE_BINARIES_ROOT are world-writable so that
+ * multiple users on a shared machine (the /tmp case) can each cache. That means
+ * another local user could pre-create our per-uid directory and plant a
+ * malicious `.node` that we would otherwise load and *execute*. To prevent
+ * that, the per-uid dir must be owned by us, be a real directory (not a
+ * symlink), and not be writable by group or other. If any of those fail we
+ * refuse the cache and fall back to loading in place.
+ */
+export function ensureSecureNativeFileCacheLocation(): string | null {
+  if (process.env.NX_NATIVE_FILE_CACHE_DIRECTORY) {
+    // Caller-provided location; its safety is the caller's responsibility.
+    const dir = process.env.NX_NATIVE_FILE_CACHE_DIRECTORY;
     try {
-      hash.update(userInfo().username);
-    } catch (e) {
-      // if there's no user, we only use the workspace root for the hash and move on
-    }
-
-    // The cache lives under the fixed NX_TMP_DIR root rather than os.tmpdir():
-    // tmpdir() honors $TMPDIR, which the daemon's environment does not include
-    // (see daemon-environment.ts), and sandboxes (e.g. AI agent sandboxes)
-    // allowlist the fixed /tmp/.nx root via `nx configure-ai-agents` — a
-    // tmpdir()-based location would be unwritable there and the native binding
-    // would fail to load.
-    return join(
-      NX_TMP_DIR,
-      `native-file-cache-${hash.digest('hex').substring(0, 7)}`
-    );
+      mkdirSync(dir, { recursive: true });
+      return dir;
+    } catch {
+      return null;
+    }
+  }
+
+  const userDir = join(NATIVE_BINARIES_ROOT, getUserSegment());
+
+  try {
+    // Create the shared root world-writable + sticky, like /tmp itself, so
+    // peers can make their own per-uid dirs. chmod only succeeds for the
+    // creating user, hence best-effort.
+    mkdirSync(NATIVE_BINARIES_ROOT, { recursive: true });
+    if (canCheckOwnership()) {
+      try {
+        chmodSync(NX_TMP_DIR, 0o1777);
+        chmodSync(NATIVE_BINARIES_ROOT, 0o1777);
+      } catch {}
+    }
+  } catch {
+    return null;
+  }
+
+  if (!ensureOwnedPrivateDir(userDir)) {
+    return null;
   }
+
+  const versionDir = join(userDir, nxVersion);
+  try {
+    mkdirSync(versionDir, { recursive: true });
+  } catch {
+    return null;
+  }
+  return versionDir;
+}
+
+/**
+ * Ensure `dir` exists, is owned by the current user, is a real directory (not a
+ * symlink), and is not writable by group or other (mode 0700). Returns false if
+ * it exists but fails any of those checks — i.e. it may have been planted by
+ * another user through the world-writable parent.
+ */
+function ensureOwnedPrivateDir(dir: string): boolean {
+  try {
+    mkdirSync(dir, { mode: 0o700 });
+    // We just created it, so it is ours and private.
+    return true;
+  } catch (e: any) {
+    if (e?.code !== 'EEXIST') {
+      return false;
+    }
+  }
+
+  // The dir already existed — verify it is safe to use.
+  if (typeof process.getuid !== 'function') {
+    // No POSIX ownership model (Windows). NX_TMP_DIR there is the per-user OS
+    // temp dir, not a shared /tmp, so cross-user planting is not a concern.
+    return true;
+  }
+  const myUid = process.getuid();
+
+  try {
+    const stats = lstatSync(dir);
+    if (!stats.isDirectory()) {
+      return false;
+    }
+    if (stats.uid !== myUid) {
+      return false;
+    }
+    // No write bits for group (0o020) or other (0o002).
+    if (stats.mode & 0o022) {
+      // Try to lock it down; if we can't, refuse.
+      try {
+        chmodSync(dir, 0o700);
+      } catch {
+        return false;
+      }
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function canCheckOwnership(): boolean {
+  return typeof process.getuid === 'function';
+}
+
+function getUserSegment(): string {
+  try {
+    if (typeof process.getuid === 'function') {
+      return String(process.getuid());
+    }
+  } catch {}
+  try {
+    const { username } = userInfo();
+    if (username) {
+      return username;
+    }
+  } catch {}
+  return 'unknown';
 }