openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-31 19:28:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Enable MXC TTY launches and managed networking in the exec server (#45524)

Browse Source 
## What changed

- Report `windows_mxc` from native MXC availability on Windows.
- Allow MXC TTY launches and managed networking, using dedicated proxy listeners without requiring a shared-ingress restricting SID.
- Reject MXC custom `argv0` and private-desktop launches, and continue failing closed when native MXC is unavailable.

## Testing

Extend the Windows remote sandbox process-write test to cover MXC with both pipes and ConPTY. Retain coverage for rejecting MXC requests when native support is unavailable.

GitOrigin-RevId: 80c5f319b9066d06b26f0a7eb7119a109e6ebef7
This commit is contained in:
iceweasel-oai
2026-09-14 21:45:09 +00:00
committed by copyberry
parent e84a594636
commit 60e35765c3
7 changed files with 72 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/exec-server/src/process_sandbox.rs
+30 -20
View File
@@ -5,6 +5,7 @@ use crate::process_telemetry::ProcessTelemetry;
use codex_exec_server_protocol::JSONRPCErrorError;
use codex_network_proxy::CUSTOM_CA_ENV_KEYS;
use codex_network_proxy::ManagedNetworkSandboxContext;
use codex_network_proxy::ManagedProxyRouting;
use codex_network_proxy::NetworkPolicyAuditObserver;
use codex_network_proxy::NetworkPolicyDecider;
use codex_network_proxy::NetworkProxy;
@@ -14,6 +15,7 @@ use codex_network_proxy::RemoteNetworkProxyLaunchConfig;
use codex_network_proxy::is_managed_mitm_ca_trust_bundle_path;
#[cfg(target_os = "windows")]
use codex_network_proxy::strip_managed_proxy_env;
use codex_protocol::config_types::WindowsSandboxLevel;
use codex_protocol::models::PermissionProfile;
use codex_sandboxing::SandboxCommand;
use codex_sandboxing::SandboxDirectSpawnTransformRequest;
@@ -87,17 +89,9 @@ pub(crate) async fn prepare_exec_request_with_telemetry(
if let Some(sandbox) = params.sandbox.as_ref()
&& sandbox.windows_sandbox_level == codex_protocol::config_types::WindowsSandboxLevel::Mxc
{
if params.tty || params.arg0.is_some() {
if params.arg0.is_some() || sandbox.windows_sandbox_private_desktop {
return Err(invalid_params(
"MXC currently supports ordinary pipe launches only".to_owned(),
));
}
if params.enforce_managed_network
|| params.managed_network.is_some()
|| params.network_proxy.is_some()
{
return Err(invalid_params(
"MXC managed networking is not supported yet".to_owned(),
"MXC custom argv0 and private-desktop launches are not supported".to_owned(),
));
}
if !codex_sandboxing::windows_mxc_available() {
@@ -126,6 +120,15 @@ pub(crate) async fn prepare_exec_request_with_telemetry(
prepare_managed_network(
params.managed_network.as_ref(),
network_proxy,
if params
.sandbox
.as_ref()
.is_some_and(|sandbox| sandbox.windows_sandbox_level == WindowsSandboxLevel::Mxc)
{
ManagedProxyRouting::DedicatedListeners
} else {
ManagedProxyRouting::SharedIngress
},
env,
network_policy_decider,
network_policy_audit_observer,
@@ -328,6 +331,7 @@ pub(crate) async fn prepare_exec_request_with_telemetry(
async fn prepare_managed_network(
managed_network: Option<&ManagedNetworkSandboxContext>,
network_proxy: Option<&RemoteNetworkProxyLaunchConfig>,
routing: ManagedProxyRouting,
env: HashMap<String, String>,
network_policy_decider: Option<Arc<dyn NetworkPolicyDecider>>,
network_policy_audit_observer: Option<NetworkPolicyAuditObserver>,
@@ -363,7 +367,9 @@ async fn prepare_managed_network(
registration_id: registration.executor_registration_id.clone(),
}),
});
let mut builder = NetworkProxy::builder().state(Arc::new(state));
let mut builder = NetworkProxy::builder()
.state(Arc::new(state))
.managed_proxy_routing(routing);
if let Some(network_policy_decider) = network_policy_decider {
builder = builder.policy_decider_arc(network_policy_decider);
}
@@ -376,15 +382,19 @@ async fn prepare_managed_network(
.await
.map_err(|err| internal_error(format!("failed to start executor network proxy: {err}")))?;
#[cfg(target_os = "windows")]
let network_proxy_restricting_sid = Some(
proxy
.network_proxy_restricting_sid(/*environment_id*/ None)
.ok_or_else(|| {
internal_error(
"managed Windows proxy route is missing its restricting SID".to_string(),
)
})?,
);
let network_proxy_restricting_sid = if routing == ManagedProxyRouting::SharedIngress {
Some(
proxy
.network_proxy_restricting_sid(/*environment_id*/ None)
.ok_or_else(|| {
internal_error(
"managed Windows proxy route is missing its restricting SID".to_string(),
)
})?,
)
} else {
None
};
#[cfg(not(target_os = "windows"))]
let network_proxy_restricting_sid = None;
let prepared = proxy
codex-rs/exec-server/src/process_sandbox_tests.rs
+11 -23
View File
@@ -133,29 +133,17 @@ async fn sandbox_request_wraps_native_argv_on_executor() {
let mut params = params;
params.sandbox.as_mut().unwrap().windows_sandbox_level =
codex_protocol::config_types::WindowsSandboxLevel::Mxc;
for (tty, managed, message) in [
(false, false, "native MXC is unavailable on this executor"),
(
true,
false,
"MXC currently supports ordinary pipe launches only",
),
(false, true, "MXC managed networking is not supported yet"),
] {
params.tty = tty;
params.enforce_managed_network = managed;
let error = prepare_exec_request(
&params,
HashMap::new(),
Some(&runtime_paths),
/*network_policy_decider*/ None,
/*network_policy_audit_observer*/ None,
)
.await
.err()
.expect("unsupported MXC must fail closed");
assert_eq!(error.message, message);
}
let error = prepare_exec_request(
&params,
HashMap::new(),
Some(&runtime_paths),
/*network_policy_decider*/ None,
/*network_policy_audit_observer*/ None,
)
.await
.err()
.expect("unsupported MXC must fail closed");
assert_eq!(error.message, "native MXC is unavailable on this executor");
}
#[cfg(unix)]