fix: fix nodejs env missing some system call

[fatelei]

fix issue langgenius/dify#28932

1. ActKillProcess change to ActErrno.SetReturnCode(1)

The Problem with ActKillProcess

ActKillProcess has issues with the TSYNC flag (synchronizes filter across threads) that causes spurious process kills. This appears to be a known issue with libseccomp or kernel behavior in certain scenarios.

The Solution

Use ActErrno.SetReturnCode(1) which:

• ✅ Still secure: Blocks unexpected syscalls with EPERM (operation not permitted)
• ✅ Reliable: Works correctly with the current allowlist
• ✅ Graceful: Allows proper error handling instead of abrupt process termination

2. add missing systemcall

• Added missing syscalls: SYS_SENDMSG, SYS_FACCESSAT, SYS_PREAD64, etc.
• Moved SYS_CLONE, SYS_CLONE3 to ALLOW_SYSCALLS (needed for threading)
• Added io_uring syscalls (425, 426, 427)

internal/static/nodejs_syscall/syscalls_amd64.go

• Aligned structure with ARM64 file
• Added SYS_SENDMSG to network syscalls

For newer syscalls like clone3 (435), rseq (293), statx (291), and io_uring (425-427):

This FAILS with libseccomp 2.6.0:

syscall, _ := sg.GetSyscallFromName("clone3")
ctx.AddRule(syscall, sg.ActAllow) // Error!

This WORKS - using raw number:

ctx.AddRule(sg.ScmpSyscall(435), sg.ActAllow) // Success

Reason: libseccomp 2.6.0 has a known limitation where it can resolve the syscall name but fails to add the rule for newer syscalls. Using raw syscall numbers bypasses this bug.

3. add nodejs ca certificate
   After chroot(), the filesystem root changes. Node.js's TLS modules (https, undici/fetch) expect CA certificates at:

• /etc/ssl/certs/ca-certificates.crt (Debian/Ubuntu)
• /etc/pki/tls/certs/ca-bundle.crt (RHEL/CentOS)

While these files are copied into the chroot via REQUIRED_FS, Node.js doesn't automatically find them in the chrooted environment.

The Solution

Two-layer approach:

• Environment variable (nodejs.go):
  cmd.Env = append(cmd.Env, "NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt"), Helps https module find certificates

• Explicit configuration (prescript.js):
  const caCert = fs.readFileSync('/etc/ssl/certs/ca-certificates.crt', 'utf8')

• For https module
  https.globalAgent.options.ca = caCert

• For undici (fetch)
  const { setGlobalDispatcher, Agent } = globalThis.undici
  const agent = new Agent({ connect: { ca: caCert } })
  setGlobalDispatcher(agent)

• Ensures fetch (undici) can verify TLS certificates

Why Both Are Needed

• NODE_EXTRA_CA_CERTS: Works for https module, not for fetch
• Explicit configuration: Required for fetch since undici doesn't respect the environment variable

before bugfix

test below

in amd64 env

in arm64 env

in docker env