permission: enforce addon permission in GetLinkedBinding

src/node_binding.cc

@@ -672,6 +672,9 @@ void GetLinkedBinding(const FunctionCallbackInfo<Value>& args) {
 
   node::Utf8Value module_name_v(env->isolate(), module_name);
   const char* name = *module_name_v;
+  THROW_IF_INSUFFICIENT_PERMISSIONS(
+      env, permission::PermissionScope::kAddon, module_name_v.ToStringView());
+
   node_module* mod = nullptr;
 
   // Iterate from here to the nearest non-Worker Environment to see if there's

test/parallel/test-permission-linked-binding-drop.js

@@ -0,0 +1,19 @@
+// Flags: --permission --allow-addons --allow-fs-read=*
+'use strict';
+
+const common = require('../common');
+const assert = require('node:assert');
+
+assert.strictEqual(process.permission.has('addon'), true);
+
+process.permission.drop('addon');
+
+assert.strictEqual(process.permission.has('addon'), false);
+
+assert.throws(() => {
+  process._linkedBinding('missing');
+}, common.expectsError({
+  code: 'ERR_ACCESS_DENIED',
+  permission: 'Addon',
+  resource: 'missing',
+}));

test/parallel/test-permission-linked-binding.js

@@ -0,0 +1,15 @@
+// Flags: --permission --allow-fs-read=*
+'use strict';
+
+const common = require('../common');
+const assert = require('node:assert');
+
+assert.strictEqual(process.permission.has('addon'), false);
+
+assert.throws(() => {
+  process._linkedBinding('missing');
+}, common.expectsError({
+  code: 'ERR_ACCESS_DENIED',
+  permission: 'Addon',
+  resource: 'missing',
+}));