openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-07 20:30:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Centralize Windows sandbox filesystem override resolution (#60042)

Browse Source 
Add `WindowsSandboxFilesystemOverrides::resolve` to select the elevated or
restricted-token resolver, and use it in core, exec-server, and direct-spawn
sandbox preparation. Pass the child environment through to the elevated
resolver.

Replace the exported unsupported-sandbox reason helper with a test-local
wrapper around the shared resolver.

GitOrigin-RevId: f1d404356a4f680ce81123bc8284508f27d4d6ab
This commit is contained in:
viyatb-oai
2026-11-07 02:46:41 +00:00
committed by copyberry
parent 11ca3f7531
commit a90c808408
7 changed files with 68 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/exec-server/src/process_sandbox.rs
+7 -20
View File
@@ -26,9 +26,6 @@ use codex_sandboxing::SandboxType;
use codex_sandboxing::WindowsSandboxFilesystemOverrides;
use codex_sandboxing::WindowsSandboxProxySettingsMode;
use codex_sandboxing::WindowsSandboxSpawnRequest;
use codex_sandboxing::resolve_windows_elevated_filesystem_overrides;
use codex_sandboxing::resolve_windows_restricted_token_filesystem_overrides;
use codex_sandboxing::windows_sandbox_uses_elevated_backend;
use codex_sandboxing::with_managed_mitm_ca_readable_root;
#[cfg(windows)]
use codex_shell_command::shell_detect::fallback_powershell_shell_for_windows_sandbox;
@@ -313,23 +310,13 @@ pub(crate) async fn prepare_exec_request_with_telemetry(
})?;
request.arg0 = params.arg0.clone();
let proxy_enforced = params.enforce_managed_network;
let use_elevated = windows_sandbox_uses_elevated_backend(windows_sandbox_level);
let filesystem_overrides = if use_elevated {
resolve_windows_elevated_filesystem_overrides(
sandbox,
&permissions,
&native_sandbox_policy_cwd,
use_elevated,
&request.env,
)
} else {
resolve_windows_restricted_token_filesystem_overrides(
sandbox,
&permissions,
&native_sandbox_policy_cwd,
windows_sandbox_level,
)
}
let filesystem_overrides = WindowsSandboxFilesystemOverrides::resolve(
sandbox,
&permissions,
&native_sandbox_policy_cwd,
windows_sandbox_level,
&request.env,
)
.map_err(|err| invalid_params(format!("failed to prepare process sandbox: {err}")))?;
Some(PreparedWindowsSandboxRequest {
permission_profile: permissions,