doc: NODE_EXTRA_CA_CERTS is ignored if setuid root

[bnoordhuis]

Fixes: #22081

[nodejs-github-bot]

@bnoordhuis build started: https://ci.nodejs.org/blue/organizations/jenkins/node-test-pull-request-lite-pipeline/detail/node-test-pull-request-lite-pipeline/1306/pipeline

[vsemozhetbyt]

Commit title nit. From the guide:

The first line should... be prefixed with the name of the changed subsystem and start with an imperative verb

[vsemozhetbyt]

FWIW: just to be sure that this file for the node --help output need not be updated in this case (it has only brief descriptions):

node/lib/internal/print_help.js

Lines 18 to 19 in e7f710c

	['NODE_EXTRA_CA_CERTS', { helpText: 'path to additional CA certificates ' +
	'file' }],

[richardlau]

NODE_PATH is also similarly affected -- do we know of any others?

[bnoordhuis]

and start with an imperative verb

I know, but I couldn't fit that in 50 columns. :-) (and it's describing the status quo, not changing it.)

do we know of any others?

$ git grep 'SafeGetenv("' src/
src/env.cc:208:  SafeGetenv("NODE_DEBUG_NATIVE", &debug_cats);
src/node.cc:2527:        SafeGetenv("NODE_PENDING_DEPRECATION", &text) && text[0] == '1';
src/node.cc:2534:        SafeGetenv("NODE_PRESERVE_SYMLINKS", &text) && text[0] == '1';
src/node.cc:2540:        SafeGetenv("NODE_PRESERVE_SYMLINKS_MAIN", &text) && text[0] == '1';
src/node.cc:2544:    SafeGetenv("NODE_REDIRECT_WARNINGS",
src/node.cc:2551:    SafeGetenv("OPENSSL_CONF", openssl_config);
src/node.cc:2557:  if (SafeGetenv("NODE_OPTIONS", &node_options)) {
src/node.cc:2589:    SafeGetenv("NODE_ICU_DATA", &per_process_opts->icu_data_dir);
src/node.cc:2985:    if (SafeGetenv("NODE_EXTRA_CA_CERTS", &extra_ca_certs))

[richardlau]

I think we also expose SafeGetenv on the internal util module (at least that seems to be how NODE_PATH is affected). (Sorry, on a tablet for the rest of the weekend so cannot run grep on the source tree).

Anyway that is more than a handful of the environment variables being affected. Should we similarly add the same sentences to all of them? Or maybe another section with the sentences and a list of affected variables? (Can be done in a follow up PR -- I'm okay for this to land as-is.)

[refack]

$ git grep 'SafeGetenv("'

Spin these off to a new bug (might even be a good first issue).

[addaleax]

Landed in cc750b7