openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-20 17:38:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Sandbox remote exec commands on the executor

Browse Source
This commit is contained in:
jif-oai
2026-06-19 15:42:08 +02:00
parent 81b000421d
commit 76ee400c29
20 changed files with 392 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/exec-server/src/environment.rs
+2
View File
@@ -1156,6 +1156,8 @@ mod tests {
tty: false,
pipe_stdin: false,
arg0: None,
sandbox: None,
enforce_managed_network: false,
})
.await
.expect("start process");
codex-rs/exec-server/src/lib.rs
+1
View File
@@ -16,6 +16,7 @@ mod noise_channel;
mod noise_relay;
mod process;
mod process_id;
mod process_sandbox;
mod protocol;
mod regular_file;
mod relay;
codex-rs/exec-server/src/local_process.rs
+2
View File
@@ -902,6 +902,8 @@ mod tests {
tty: false,
pipe_stdin: false,
arg0: None,
sandbox: None,
enforce_managed_network: false,
}
}
codex-rs/exec-server/src/process_sandbox.rs
+182
View File
@@ -0,0 +1,182 @@
use crate::ExecServerRuntimePaths;
use crate::protocol::ExecParams;
use crate::rpc::invalid_params;
use codex_app_server_protocol::JSONRPCErrorError;
#[cfg(target_os = "linux")]
use codex_protocol::models::PermissionProfile;
#[cfg(target_os = "linux")]
use codex_sandboxing::SandboxCommand;
#[cfg(target_os = "linux")]
use codex_sandboxing::SandboxManager;
#[cfg(target_os = "linux")]
use codex_sandboxing::SandboxTransformRequest;
#[cfg(target_os = "linux")]
use codex_sandboxing::SandboxType;
#[cfg(target_os = "linux")]
use codex_sandboxing::SandboxablePreference;
/// Converts a remote launch's sandbox policy into this Linux host's native wrapper.
#[cfg(target_os = "linux")]
pub(crate) fn prepare_exec_params(
mut params: ExecParams,
runtime_paths: &ExecServerRuntimePaths,
) -> Result<ExecParams, JSONRPCErrorError> {
let Some(sandbox_context) = params.sandbox.take() else {
return Ok(params);
};
let native_permissions: PermissionProfile = sandbox_context
.permissions
.try_into()
.map_err(|err| invalid_params(format!("invalid sandbox permission path URI: {err}")))?;
let (file_system_policy, network_policy) = native_permissions.to_runtime_permissions();
let sandbox_manager = SandboxManager::new();
let sandbox = sandbox_manager.select_initial(
&file_system_policy,
network_policy,
SandboxablePreference::Auto,
sandbox_context.windows_sandbox_level,
params.enforce_managed_network,
);
if sandbox == SandboxType::None {
return Ok(params);
}
let (program, args) = params
.argv
.split_first()
.ok_or_else(|| invalid_params("argv must not be empty".to_string()))?;
let command = SandboxCommand {
program: program.into(),
args: args.to_vec(),
cwd: params.cwd.clone(),
env: params.env.clone(),
additional_permissions: None,
};
let sandbox_policy_cwd = sandbox_context.cwd.as_ref().unwrap_or(&params.cwd);
let request = sandbox_manager
.transform(SandboxTransformRequest {
command,
permissions: &native_permissions,
sandbox,
enforce_managed_network: params.enforce_managed_network,
environment_id: None,
network: None,
sandbox_policy_cwd,
codex_linux_sandbox_exe: runtime_paths.codex_linux_sandbox_exe.as_deref(),
use_legacy_landlock: sandbox_context.use_legacy_landlock,
windows_sandbox_level: sandbox_context.windows_sandbox_level,
windows_sandbox_private_desktop: sandbox_context.windows_sandbox_private_desktop,
})
.map_err(|err| invalid_params(format!("failed to prepare process sandbox: {err}")))?;
params.argv = request.command;
params.env = request.env;
params.arg0 = request.arg0;
Ok(params)
}
#[cfg(not(target_os = "linux"))]
pub(crate) fn prepare_exec_params(
mut params: ExecParams,
_runtime_paths: &ExecServerRuntimePaths,
) -> Result<ExecParams, JSONRPCErrorError> {
if params.sandbox.take().is_none() {
return Ok(params);
}
Err(invalid_params(
"sandboxed remote process launches require a Linux exec-server".to_string(),
))
}
#[cfg(all(test, target_os = "linux"))]
mod tests {
use std::collections::HashMap;
use codex_protocol::permissions::FileSystemSandboxPolicy;
use codex_protocol::permissions::NetworkSandboxPolicy;
use codex_utils_path_uri::PathUri;
use pretty_assertions::assert_eq;
use super::*;
use crate::FileSystemSandboxContext;
use crate::ProcessId;
fn exec_params(
permissions: PermissionProfile,
cwd_uri: PathUri,
enforce_managed_network: bool,
) -> ExecParams {
ExecParams {
process_id: ProcessId::from("sandboxed"),
argv: vec![
"/bin/bash".to_string(),
"-lc".to_string(),
"pwd".to_string(),
],
cwd: cwd_uri.clone(),
env_policy: None,
env: HashMap::new(),
tty: false,
pipe_stdin: false,
arg0: None,
sandbox: Some(FileSystemSandboxContext::from_permission_profile_with_cwd(
permissions,
cwd_uri,
)),
enforce_managed_network,
}
}
fn runtime_paths() -> std::io::Result<ExecServerRuntimePaths> {
ExecServerRuntimePaths::new(
"/executor/codex".into(),
Some("/executor/codex-linux-sandbox".into()),
)
}
#[test]
fn remote_sandbox_uses_executor_linux_helper() {
let cwd_uri = PathUri::from_path(std::env::current_dir().expect("cwd")).expect("cwd URI");
let permissions = PermissionProfile::from_runtime_permissions(
&FileSystemSandboxPolicy::default(),
NetworkSandboxPolicy::Restricted,
);
let runtime_paths = runtime_paths().expect("runtime paths");
let params = prepare_exec_params(
exec_params(permissions, cwd_uri, /*enforce_managed_network*/ false),
&runtime_paths,
)
.expect("prepare sandbox");
assert_eq!(
params.argv.first(),
Some(&"/executor/codex-linux-sandbox".to_string())
);
assert_eq!(
params.arg0,
Some("/executor/codex-linux-sandbox".to_string())
);
assert_eq!(params.sandbox, None);
}
#[test]
fn managed_network_requires_executor_linux_helper() {
let cwd_uri = PathUri::from_path(std::env::current_dir().expect("cwd")).expect("cwd URI");
let permissions = PermissionProfile::from_runtime_permissions(
&FileSystemSandboxPolicy::unrestricted(),
NetworkSandboxPolicy::Enabled,
);
let runtime_paths = runtime_paths().expect("runtime paths");
let params = prepare_exec_params(
exec_params(permissions, cwd_uri, /*enforce_managed_network*/ true),
&runtime_paths,
)
.expect("prepare sandbox");
assert_eq!(
params.argv.first(),
Some(&"/executor/codex-linux-sandbox".to_string())
);
}
}
codex-rs/exec-server/src/protocol.rs
+7
View File
@@ -103,6 +103,13 @@ pub struct ExecParams {
/// Optional process-visible argv0 override. Values such as `codex-linux-sandbox` are command
/// names rather than paths, so this is not a [`PathUri`].
pub arg0: Option<String>,
/// Sandbox policy for this launch. The exec-server resolves this into its own platform
/// sandbox wrapper so clients never send host-local helper paths in argv.
#[serde(default)]
pub sandbox: Option<FileSystemSandboxContext>,
/// Whether this launch must keep networking restricted to the managed proxy.
#[serde(default)]
pub enforce_managed_network: bool,
}
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
codex-rs/exec-server/src/server/handler.rs
+5 -1
View File
@@ -14,6 +14,7 @@ use tokio_util::task::TaskTracker;
use crate::ExecServerRuntimePaths;
use crate::client::http_client::PendingReqwestHttpBodyStream;
use crate::client::http_client::ReqwestHttpRequestRunner;
use crate::process_sandbox::prepare_exec_params;
use crate::protocol::EnvironmentInfo;
use crate::protocol::ExecParams;
use crate::protocol::ExecResponse;
@@ -66,6 +67,7 @@ pub(crate) struct ExecServerHandler {
background_task_shutdown: CancellationToken,
background_tasks: TaskTracker,
file_system: FileSystemHandler,
runtime_paths: ExecServerRuntimePaths,
initialize_requested: AtomicBool,
initialized: AtomicBool,
}
@@ -83,7 +85,8 @@ impl ExecServerHandler {
active_body_stream_ids: Mutex::new(HashSet::new()),
background_task_shutdown: CancellationToken::new(),
background_tasks: TaskTracker::new(),
file_system: FileSystemHandler::new(runtime_paths),
file_system: FileSystemHandler::new(runtime_paths.clone()),
runtime_paths,
initialize_requested: AtomicBool::new(false),
initialized: AtomicBool::new(false),
}
@@ -150,6 +153,7 @@ impl ExecServerHandler {
pub(crate) async fn exec(&self, params: ExecParams) -> Result<ExecResponse, JSONRPCErrorError> {
let session = self.require_initialized_for("exec")?;
let params = prepare_exec_params(params, &self.runtime_paths)?;
session.process().exec(params).await
}
codex-rs/exec-server/src/server/handler/tests.rs
+2
View File
@@ -33,6 +33,8 @@ fn exec_params_with_argv(process_id: &str, argv: Vec<String>) -> ExecParams {
tty: false,
pipe_stdin: false,
arg0: None,
sandbox: None,
enforce_managed_network: false,
}
}
codex-rs/exec-server/src/server/processor.rs
+2
View File
@@ -403,6 +403,8 @@ mod tests {
tty: false,
pipe_stdin: false,
arg0: None,
sandbox: None,
enforce_managed_network: false,
}
}
codex-rs/exec-server/tests/exec_process.rs
+24
View File
@@ -81,6 +81,8 @@ async fn assert_exec_process_starts_and_exits(use_remote: bool) -> Result<()> {
tty: false,
pipe_stdin: false,
arg0: None,
sandbox: None,
enforce_managed_network: false,
})
.await?;
assert_eq!(session.process.process_id().as_str(), "proc-1");
@@ -222,6 +224,8 @@ async fn assert_exec_process_streams_output(use_remote: bool) -> Result<()> {
tty: false,
pipe_stdin: false,
arg0: None,
sandbox: None,
enforce_managed_network: false,
})
.await?;
assert_eq!(session.process.process_id().as_str(), process_id);
@@ -253,6 +257,8 @@ async fn assert_exec_process_pushes_events(use_remote: bool) -> Result<()> {
tty: false,
pipe_stdin: false,
arg0: None,
sandbox: None,
enforce_managed_network: false,
})
.await?;
assert_eq!(session.process.process_id().as_str(), process_id);
@@ -300,6 +306,8 @@ async fn assert_exec_process_replays_events_after_close(use_remote: bool) -> Res
tty: false,
pipe_stdin: false,
arg0: None,
sandbox: None,
enforce_managed_network: false,
})
.await?;
assert_eq!(session.process.process_id().as_str(), process_id);
@@ -348,6 +356,8 @@ async fn assert_exec_process_retains_output_after_exit_until_streams_close(
tty: false,
pipe_stdin: false,
arg0: None,
sandbox: None,
enforce_managed_network: false,
})
.await?;
assert_eq!(session.process.process_id().as_str(), process_id);
@@ -421,6 +431,8 @@ async fn assert_exec_process_write_then_read(use_remote: bool) -> Result<()> {
tty: true,
pipe_stdin: false,
arg0: None,
sandbox: None,
enforce_managed_network: false,
})
.await?;
assert_eq!(session.process.process_id().as_str(), process_id);
@@ -458,6 +470,8 @@ async fn assert_exec_process_write_then_read_without_tty(use_remote: bool) -> Re
tty: false,
pipe_stdin: true,
arg0: None,
sandbox: None,
enforce_managed_network: false,
})
.await?;
assert_eq!(session.process.process_id().as_str(), process_id);
@@ -491,6 +505,8 @@ async fn assert_exec_process_rejects_write_without_pipe_stdin(use_remote: bool)
tty: false,
pipe_stdin: false,
arg0: None,
sandbox: None,
enforce_managed_network: false,
})
.await?;
assert_eq!(session.process.process_id().as_str(), process_id);
@@ -525,6 +541,8 @@ async fn assert_exec_process_signal_interrupts_process(use_remote: bool) -> Resu
tty: false,
pipe_stdin: false,
arg0: None,
sandbox: None,
enforce_managed_network: false,
})
.await?;
assert_eq!(session.process.process_id().as_str(), process_id);
@@ -578,6 +596,8 @@ async fn assert_exec_process_signal_reports_unsupported_on_windows(use_remote: b
tty: false,
pipe_stdin: false,
arg0: None,
sandbox: None,
enforce_managed_network: false,
})
.await?;
@@ -618,6 +638,8 @@ async fn assert_exec_process_preserves_queued_events_before_subscribe(
tty: false,
pipe_stdin: false,
arg0: None,
sandbox: None,
enforce_managed_network: false,
})
.await?;
@@ -676,6 +698,8 @@ async fn remote_exec_process_recovers_after_transport_disconnect() -> Result<()>
tty: false,
pipe_stdin: true,
arg0: None,
sandbox: None,
enforce_managed_network: false,
})
.await?;
codex-rs/exec-server/tests/relay.rs
+2
View File
@@ -150,6 +150,8 @@ async fn remote_environment_routes_encrypted_exec_server_rpc() -> Result<()> {
tty: false,
pipe_stdin: false,
arg0: None,
sandbox: None,
enforce_managed_network: false,
})
.await?;
assert_eq!(