openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-09-14 11:57:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(linux-sandbox): inline nested proxy fallback predicate

Browse Source
This commit is contained in:
viyatb-oai
2026-02-23 12:46:49 -08:00
parent 0638857fd2
commit 32f45394fd
2 changed files with 2 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
codex-rs/linux-sandbox/src/linux_run_main.rs
View File

@@ -90,10 +90,8 @@ pub fn run_main() -> ! {
}
ensure_inner_stage_mode_is_valid(apply_seccomp_then_exec, use_bwrap_sandbox);
let disable_nested_managed_proxy = should_disable_managed_proxy_for_nested_bwrap(
allow_network_for_proxy,
apply_seccomp_then_exec,
);
let disable_nested_managed_proxy =
allow_network_for_proxy && !apply_seccomp_then_exec && has_bwrap_ancestor();
if disable_nested_managed_proxy {
eprintln!(
"codex-linux-sandbox: nested Codex bubblewrap sandbox detected; \
@@ -191,25 +189,6 @@ fn ensure_inner_stage_mode_is_valid(apply_seccomp_then_exec: bool, use_bwrap_san
}
}
fn should_disable_managed_proxy_for_nested_bwrap(
allow_network_for_proxy: bool,
apply_seccomp_then_exec: bool,
) -> bool {
should_disable_managed_proxy_for_nested_bwrap_with_ancestor_bwrap(
allow_network_for_proxy,
apply_seccomp_then_exec,
has_bwrap_ancestor(),
)
}
fn should_disable_managed_proxy_for_nested_bwrap_with_ancestor_bwrap(
allow_network_for_proxy: bool,
apply_seccomp_then_exec: bool,
has_bwrap_ancestor: bool,
) -> bool {
allow_network_for_proxy && !apply_seccomp_then_exec && has_bwrap_ancestor
}
fn has_bwrap_ancestor() -> bool {
const MAX_ANCESTOR_DEPTH: usize = 32;
let mut pid = match parent_pid_of(std::process::id()) {

20
codex-rs/linux-sandbox/src/linux_run_main_tests.rs
View File

@@ -157,23 +157,3 @@ fn valid_inner_stage_modes_do_not_panic() {
ensure_inner_stage_mode_is_valid(false, true);
ensure_inner_stage_mode_is_valid(true, true);
}
#[test]
fn nested_managed_proxy_fallback_only_applies_to_outer_stage() {
assert_eq!(
should_disable_managed_proxy_for_nested_bwrap_with_ancestor_bwrap(true, false, true),
true
);
assert_eq!(
should_disable_managed_proxy_for_nested_bwrap_with_ancestor_bwrap(true, true, true),
false
);
assert_eq!(
should_disable_managed_proxy_for_nested_bwrap_with_ancestor_bwrap(true, false, false),
false
);
assert_eq!(
should_disable_managed_proxy_for_nested_bwrap_with_ancestor_bwrap(false, false, true),
false
);
}