From 1dac3d9ca04a347632056f752b15ddfa4d7cd757 Mon Sep 17 00:00:00 2001 From: jif Date: Tue, 11 Aug 2026 15:47:03 +0000 Subject: [PATCH] Fail closed on unsafe Linux unreadable globs (#38026) ## Why Linux sandbox unreadable globs without a non-root directory prefix cannot be safely expanded because they would require scanning from `/`. Silently skipping these patterns leaves the requested deny-read rule unenforced. ## What changed Return a fatal sandbox construction error when an unreadable glob cannot be split into a safe ripgrep search root. The error directs callers to use a pattern with a non-root directory prefix. ## Testing Add a regression test confirming that `/**/*.env` rejects Bubblewrap command construction. GitOrigin-RevId: 2f3cb398d39a9bc077d3a1b74e08dc506d239e60 --- codex-rs/linux-sandbox/src/bwrap.rs | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/codex-rs/linux-sandbox/src/bwrap.rs b/codex-rs/linux-sandbox/src/bwrap.rs index f0e188b255..76853ed337 100644 --- a/codex-rs/linux-sandbox/src/bwrap.rs +++ b/codex-rs/linux-sandbox/src/bwrap.rs @@ -718,9 +718,12 @@ fn expand_unreadable_globs_with_ripgrep( // lets one `rg --files` call handle all patterns under the same root. let mut patterns_by_search_root: BTreeMap> = BTreeMap::new(); for pattern in patterns { - if let Some((search_root, glob)) = split_pattern_for_ripgrep(pattern, cwd) - && search_root.as_path().is_dir() - { + let Some((search_root, glob)) = split_pattern_for_ripgrep(pattern, cwd) else { + return Err(CodexErr::Fatal(format!( + "unreadable glob `{pattern}` cannot be safely expanded; use a pattern with a non-root directory prefix" + ))); + }; + if search_root.as_path().is_dir() { patterns_by_search_root .entry(search_root) .or_default() @@ -2674,10 +2677,20 @@ mod tests { } #[test] - fn root_prefix_unreadable_globs_are_too_broad_for_linux_expansion() { + fn root_prefix_unreadable_globs_fail_closed_on_linux() { + let policy = default_policy_with_unreadable_glob("/**/*.env".to_string()); + let error = create_bwrap_command_args( + vec!["/bin/true".to_string()], + &policy, + Path::new("/tmp"), + Path::new("/tmp"), + BwrapOptions::default(), + ) + .expect_err("root-prefix deny-read glob must reject sandbox construction"); + assert_eq!( - split_pattern_for_ripgrep("/**/*.env", Path::new("/tmp")), - None + error.to_string(), + "Fatal error: unreadable glob `/**/*.env` cannot be safely expanded; use a pattern with a non-root directory prefix" ); }