src: don't fail startup on unreadable OpenSSL config

OpenSSL is initialized with CONF_MFLAGS_IGNORE_MISSING_FILE so that a
missing configuration file does not prevent Node.js from starting, but
that flag does not cover a file that exists and cannot be opened.
Running in a container where /etc/ssl is not accessible to the current
user therefore aborts startup with:

  OpenSSL configuration error:
  ...:BIO_new_file:Permission denied:...fopen(/etc/ssl/openssl.cnf, rb)

Ignore the error when the unreadable file is the default configuration
file, that is, one that was not requested via OPENSSL_CONF or
--openssl-config. Errors from an explicitly requested file, and from
the files it includes, stay fatal.

Fixes: #62230
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Orgad Shaneh <orgad.shaneh@audiocodes.com>

Author: orgads

src/node.cc

@@ -48,6 +48,7 @@
 #include "node_version.h"
 
 #if HAVE_OPENSSL
+#include <openssl/conf.h>
 #include "ncrypto.h"
 #include "node_crypto.h"
 #if OPENSSL_VERSION_MAJOR >= 3 && !defined(CONF_MFLAGS_IGNORE_MISSING_FILE)
@@ -135,6 +136,7 @@
 #include <cstdlib>
 #include <cstring>
 
+#include <fstream>
 #include <string>
 #include <tuple>
 #include <vector>
@@ -1099,6 +1101,17 @@ bool CanEnableWebAssemblyTrapHandler() {
 }
 #endif  // NODE_USE_V8_WASM_TRAP_HANDLER
 
+#if HAVE_OPENSSL && !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_MAJOR >= 3
+// Whether the configuration file that OpenSSL uses when none was requested
+// explicitly can be opened for reading.
+static bool DefaultOpenSSLConfIsReadable() {
+  char* path = CONF_get1_default_config_file();
+  if (path == nullptr) return false;
+  auto free_path = OnScopeLeave([&]() { OPENSSL_free(path); });
+  return std::ifstream(path).is_open();
+}
+#endif
+
 static std::shared_ptr<InitializationResultImpl>
 InitializeOncePerProcessInternal(const std::vector<std::string>& args,
                                  ProcessInitializationFlags::Flags flags =
@@ -1229,6 +1242,15 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
     OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, settings);
     OPENSSL_INIT_free(settings);
 
+    // CONF_MFLAGS_IGNORE_MISSING_FILE only covers a missing file, not a default
+    // configuration file that exists but cannot be opened, e.g. when /etc/ssl
+    // is not readable by the current user. Loading it was not something the
+    // user asked for, so ignore that failure as well instead of refusing to
+    // start. Refs: https://github.com/nodejs/node/issues/62230
+    if (conf_file == nullptr && !DefaultOpenSSLConfIsReadable()) {
+      ERR_clear_error();
+    }
+
     if (ERR_peek_error() != 0) {
       // XXX: ERR_GET_REASON does not return something that is
       // useful as an exit code at all.