openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-07 20:30:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Expand Linux sandbox deny globs in process (#59711)

Browse Source 
## What changed

Replace external `rg` scans and the fallback walker with an in-process `ignore` walker for bubblewrap deny-glob expansion. Remove scanner lookup and dependency tracking from sandbox integrity checks.

Include hidden and ignored files, respect scan depth limits, and fail closed on traversal errors. Anchor patterns to their static search roots and preserve literal leading `#`, leading `!`, trailing spaces, and unclosed character classes. Follow explicit symlink roots while skipping child symlinks, and mask canonical targets of matched paths.

## Testing

Extend unit and sandbox integration coverage for glob syntax, depth limits, traversal failures, symlink handling, commands launched from `/`, and operation without executing `rg`.

GitOrigin-RevId: 1767d7f37acb149457642bf24ee5971a28696438
This commit is contained in:
iceweasel-oai
2026-11-05 17:56:59 +00:00
committed by copyberry
parent 0327a3ec34
commit 2a32e7c963
9 changed files with 209 additions and 350 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/exec-server/src/sandbox_integrity/backend_tests.rs
+3 -16
View File
@@ -80,13 +80,7 @@ fn dependency_inventory_uses_launcher_location_and_command_path() -> io::Result<
fs::create_dir(&cwd)?;
fs::create_dir(&tools)?;
fs::create_dir(tools.join("codex-resources"))?;
for path in [
tools.join("bwrap"),
tools.join("rg"),
cwd.join("rg"),
tools.join("codex"),
bundled.clone(),
] {
for path in [tools.join("bwrap"), tools.join("codex"), bundled.clone()] {
fs::write(&path, "fixture")?;
fs::set_permissions(&path, fs::Permissions::from_mode(/*mode*/ 0o755))?;
}
@@ -95,18 +89,12 @@ fn dependency_inventory_uses_launcher_location_and_command_path() -> io::Result<
let policy = FileSystemSandboxPolicy::restricted(vec![deny_glob("*.key")]);
let mut request = sandbox_request(&cwd, &policy);
request.command[0] = launcher.to_string_lossy().into_owned();
for (path, scanner) in [
("../tools", tools.join("rg")),
(":../tools", tools.join("rg")),
] {
for path in ["../tools", ":../tools"] {
request.env.insert("PATH".to_owned(), path.to_owned());
let dependencies = backend::critical_dependencies(&request, &policy, &cwd)?
.into_iter()
.filter(|(name, _)| {
matches!(
*name,
"bundled_bwrap_candidate" | "system_bwrap_candidate" | "glob_scanner"
)
matches!(*name, "bundled_bwrap_candidate" | "system_bwrap_candidate")
})
.map(|(name, path)| path.and_then(fs::canonicalize).map(|path| (name, path)))
.collect::<io::Result<Vec<_>>>()?;
@@ -118,7 +106,6 @@ fn dependency_inventory_uses_launcher_location_and_command_path() -> io::Result<
"system_bwrap_candidate",
tools.join("bwrap").into_path_buf()
),
("glob_scanner", scanner.into_path_buf()),
]
);
}
codex-rs/exec-server/src/sandbox_integrity/bubblewrap.rs
+1 -18
View File
@@ -55,20 +55,6 @@ pub(super) fn critical_dependencies(
// The launcher probes this executable even if it later uses its bundled copy.
dependencies.push(("system_bwrap_candidate", Ok(bwrap)));
}
if !policy
.get_unreadable_globs_with_cwd(cwd.as_path())
.is_empty()
&& let Some(path) = &path
&& let Some(scanner) = codex_sandboxing::find_executable_in_search_paths(
codex_linux_sandbox::GLOB_SCAN_PROGRAM,
std::env::split_paths(path),
command_cwd.as_path(),
policy,
cwd.as_path(),
)
{
dependencies.push(("glob_scanner", Ok(scanner)));
}
Ok(dependencies)
}
@@ -107,13 +93,10 @@ pub(super) fn prepare_policy(
});
let patterns = policy.get_unreadable_globs_with_cwd(cwd.as_path());
if !patterns.is_empty() {
let paths = codex_linux_sandbox::expand_unreadable_globs_in_environment(
let paths = codex_linux_sandbox::expand_unreadable_globs(
&patterns,
cwd.as_path(),
&policy,
policy.glob_scan_max_depth,
&request.env,
command_cwd.as_path(),
)
.map_err(io::Error::other)?;
policy = policy.with_expanded_deny_globs(paths);