<p dir="auto">This sample illustrates what I'm talking about:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="       // Run this with:                                                                                                                
       //      deno run --allow-run ./elevation.ts                                                                                      

       if (Deno.args.includes('network')) {
         console.log('Thanks for the elevated permissions sucker!')
         const result = await fetch('https://example.com');

         console.log(result)
       } else {
         const p = Deno.run({
           cmd: ['deno', 'run', '--allow-net', './elevation.ts', 'network']
         })            
                       
         // await its completion                                                                                                        
         const code = await p.status()
       	 console.log(code)
       }
"><pre class="notranslate"><code class="notranslate">       // Run this with:                                                                                                                
       //      deno run --allow-run ./elevation.ts                                                                                      

       if (Deno.args.includes('network')) {
         console.log('Thanks for the elevated permissions sucker!')
         const result = await fetch('https://example.com');

         console.log(result)
       } else {
         const p = Deno.run({
           cmd: ['deno', 'run', '--allow-net', './elevation.ts', 'network']
         })            
                       
         // await its completion                                                                                                        
         const code = await p.status()
       	 console.log(code)
       }

</code></pre></div>
<p dir="auto">Unless Deno does some advanced cascading of ACL around further deno's spawned within its process (which it seems like it should do here) this is relaying a false sense of security to the user of the deno program.</p>
<p dir="auto">If I am a user, and I run unknown code via deno, with the assumption of deno's security protecting me (which is what the marketing blurbs seem to imply), I wouldn't expect that an --allow-run flag is giving full unfettered access to everything.</p>
<p dir="auto">As such, the allow-run flag is very misleading and should not be a distinct flag - if people need to run subprocesses, it should only be done with the allow-all flag.</p>
<p dir="auto">When you execute a subprocess there's no guarantees of what it can do - all security bets are off. <code class="notranslate">--allow-run</code> masks this and is an extra command line flag. Therefore I suggest removing it entirely and requiring users to supply <code class="notranslate">--allow-all</code>.</p>