openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-09-13 11:47:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Avoid default AppData ACL grants in Windows sandbox setup

Browse Source
This commit is contained in:
David Wiesen
2026-03-25 11:03:35 -07:00
parent ad74543a6f
commit 5dc507cd41
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs
View File

@@ -50,6 +50,7 @@ const USERPROFILE_READ_ROOT_EXCLUSIONS: &[&str] = &[
".npm",
".pki",
".terraform.d",
"AppData",
];
const WINDOWS_PLATFORM_DEFAULT_READ_ROOTS: &[&str] = &[
r"C:\Windows",
@@ -700,11 +701,13 @@ mod tests {
let allowed_file = user_profile.join(".gitconfig");
let excluded_dir = user_profile.join(".ssh");
let excluded_case_variant = user_profile.join(".AWS");
let excluded_appdata = user_profile.join("AppData");
fs::create_dir_all(&allowed_dir).expect("create allowed dir");
fs::write(&allowed_file, "safe").expect("create allowed file");
fs::create_dir_all(&excluded_dir).expect("create excluded dir");
fs::create_dir_all(&excluded_case_variant).expect("create excluded case variant");
fs::create_dir_all(excluded_appdata.join("Local")).expect("create excluded appdata");
let roots = profile_read_roots(user_profile);
let actual: HashSet<PathBuf> = roots.into_iter().collect();