fix(linux): pass the sealing key to ns-bundle via the environment

argv is readable by every local user in /proc/<pid>/cmdline; tools
without $NS_BUNDLE_KEY_HEX support still get --key-hex.

Author: triniwiz

lib/services/linux-app-bundle.ts

@@ -94,17 +94,23 @@ export class LinuxAppBundler {
 				args.push("--unpack", glob);
 			}
 		}
+		let env: NodeJS.ProcessEnv | undefined;
 		if (seal) {
 			args.push("--seal");
 			if (options.keyHex) {
-				args.push("--key-hex", options.keyHex);
+				// argv is readable by every local user; older tools only take --key-hex
+				if (await this.readsKeyFromEnv(tool, stage)) {
+					env = { ...process.env, NS_BUNDLE_KEY_HEX: options.keyHex };
+				} else {
+					args.push("--key-hex", options.keyHex);
+				}
 			}
 		}
 		args.push(...fuseArgs(true));
 		// the tool only patches the executable once the bundle is written
 		const pristine = fs.readFileSync(executable);
 		try {
-			const result = await this.run(tool, args, stage);
+			const result = await this.run(tool, args, stage, env);
 			this.$logger.info(result.stdout.trim());
 		} catch (e) {
 			for (const p of [output, unpacked]) {
@@ -128,12 +134,26 @@ export class LinuxAppBundler {
 		);
 	}
 
-	private async run(command: string, args: string[], cwd: string) {
+	private async readsKeyFromEnv(tool: string, cwd: string) {
+		try {
+			const help = await this.run(tool, ["--help"], cwd);
+			return help.stdout.includes("NS_BUNDLE_KEY_HEX");
+		} catch {
+			return false;
+		}
+	}
+
+	private async run(
+		command: string,
+		args: string[],
+		cwd: string,
+		env?: NodeJS.ProcessEnv,
+	) {
 		const result = await this.$childProcess.spawnFromEvent(
 			command,
 			args,
 			"close",
-			{ cwd },
+			env ? { cwd, env } : { cwd },
 			{ throwError: false },
 		);
 		if (result.exitCode !== 0) {

test/services/linux-app-bundle.ts

@@ -6,12 +6,24 @@ import { LinuxAppBundler } from "../../lib/services/linux-app-bundle";
 import * as stubs from "../stubs";
 
 /** Fakes ns-bundle: `pack` writes the bundle and patches the executable. */
-function fakeTool(exitCode = 0) {
+function fakeTool(exitCode = 0, keyFromEnv = true) {
 	const calls: string[][] = [];
+	const envs: (NodeJS.ProcessEnv | undefined)[] = [];
 	return {
 		calls,
-		spawnFromEvent: async (_command: string, args: string[]) => {
+		envs,
+		spawnFromEvent: async (
+			_command: string,
+			args: string[],
+			_event: string,
+			options: { env?: NodeJS.ProcessEnv },
+		) => {
+			if (args[0] === "--help") {
+				const stdout = keyFromEnv ? "usage ... $NS_BUNDLE_KEY_HEX" : "usage";
+				return { exitCode: 0, stdout, stderr: "" };
+			}
 			calls.push(args);
+			envs.push(options?.env);
 			if (exitCode === 0 && args[0] === "pack") {
 				const output = args[args.indexOf("--output") + 1];
 				fs.writeFileSync(output, "NSB2");
@@ -83,12 +95,20 @@ describe("linuxAppBundle", () => {
 		const [args] = proc.calls;
 		assert.includeMembers(args, [
 			"--seal",
-			"--key-hex",
-			"ab".repeat(32),
 			"--no-default-unpack",
 			"data/**",
 			"inspector=on",
 		]);
+		// not on argv, where other local users can read it
+		assert.notInclude(args, "ab".repeat(32));
+		assert.equal(proc.envs[0].NS_BUNDLE_KEY_HEX, "ab".repeat(32));
+	});
+
+	it("passes the key on argv to tools without NS_BUNDLE_KEY_HEX", async () => {
+		const proc = fakeTool(0, false);
+		await pack(proc, { sourceProtect: true, keyHex: "cd".repeat(32) });
+		assert.includeMembers(proc.calls[0], ["--key-hex", "cd".repeat(32)]);
+		assert.isUndefined(proc.envs[0]);
 	});
 
 	it("only sets fuses with bundle: false", async () => {