From 0462dcc062b822bb8fff16cc31ce6eeab69823b9 Mon Sep 17 00:00:00 2001
From: felixxia-oai <felixxia@openai.com>
Date: Tue, 29 Sep 2026 11:42:32 +0000
Subject: [PATCH] Use executable fixture copying in the bundled bwrap test
 (#49246)

## Why

Copying executable fixtures in the test process can expose writable file descriptors to sibling spawns. The shared `copy_executable` helper completes copies in a separate process on Linux before launching the fixtures.

## What changed

Use `copy_executable` for both `codex-linux-sandbox` and `bwrap` in `bazel_build_rejects_tampered_bundled_bwrap`, and add `codex-utils-cargo-bin` as a Linux test dependency.

GitOrigin-RevId: 05fb1381eeefb64568b525925c9e81863acc2b54
---
 codex-rs/Cargo.lock                                 |  1 +
 codex-rs/linux-sandbox/Cargo.toml                   |  1 +
 codex-rs/linux-sandbox/tests/suite/bundled_bwrap.rs | 11 ++++++++---
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/codex-rs/Cargo.lock b/codex-rs/Cargo.lock
index 19885ae975..732ef7f0b1 100644
--- a/codex-rs/Cargo.lock
+++ b/codex-rs/Cargo.lock
@@ -3756,6 +3756,7 @@ dependencies = [
  "codex-sandboxing",
  "codex-uds",
  "codex-utils-absolute-path",
+ "codex-utils-cargo-bin",
  "globset",
  "landlock",
  "libc",
diff --git a/codex-rs/linux-sandbox/Cargo.toml b/codex-rs/linux-sandbox/Cargo.toml
index 17b3fa14b1..26abe26d71 100644
--- a/codex-rs/linux-sandbox/Cargo.toml
+++ b/codex-rs/linux-sandbox/Cargo.toml
@@ -37,6 +37,7 @@ url = { workspace = true }
 
 [target.'cfg(target_os = "linux")'.dev-dependencies]
 codex-core = { workspace = true }
+codex-utils-cargo-bin = { workspace = true }
 pretty_assertions = { workspace = true }
 tempfile = { workspace = true }
 test-case = "3.3.1"
diff --git a/codex-rs/linux-sandbox/tests/suite/bundled_bwrap.rs b/codex-rs/linux-sandbox/tests/suite/bundled_bwrap.rs
index e5b1d43848..07bd3ee35b 100644
--- a/codex-rs/linux-sandbox/tests/suite/bundled_bwrap.rs
+++ b/codex-rs/linux-sandbox/tests/suite/bundled_bwrap.rs
@@ -2,7 +2,9 @@
 
 use codex_linux_sandbox::BUNDLED_BWRAP_DIGEST_VERIFICATION_FAILURE_EXIT_CODE;
 use codex_protocol::models::PermissionProfile;
+use codex_utils_cargo_bin::copy_executable;
 use pretty_assertions::assert_eq;
+use std::path::Path;
 use std::path::PathBuf;
 use std::process::Command;
 
@@ -27,11 +29,14 @@ fn bazel_build_rejects_tampered_bundled_bwrap() {
     std::fs::create_dir(&resources).expect("package resource directory should be created");
 
     let sandbox_binary = package.path().join("codex-linux-sandbox");
-    std::fs::copy(env!("CARGO_BIN_EXE_codex-linux-sandbox"), &sandbox_binary)
-        .expect("sandbox binary should be copied into the package");
+    copy_executable(
+        Path::new(env!("CARGO_BIN_EXE_codex-linux-sandbox")),
+        &sandbox_binary,
+    )
+    .expect("sandbox binary should be copied into the package");
 
     let bundled_bwrap = resources.join("bwrap");
-    std::fs::copy(&bwrap_binary, &bundled_bwrap)
+    copy_executable(&bwrap_binary, &bundled_bwrap)
         .expect("built bwrap should be copied into the package");
 
     let permission_profile = serde_json::to_string(&PermissionProfile::read_only())