openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-09-09 15:58:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(linux-sandbox): mask fragile bwrap carveout paths

Browse Source 
Co-authored-by: Codex noreply@openai.com
This commit is contained in:
viyatb-oai
2026-04-13 22:41:34 -07:00
parent 4179952552
commit badb1beb36
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
codex-rs/linux-sandbox/src/bwrap.rs
View File

@@ -543,6 +543,10 @@ fn append_read_only_subpath_args(
}
if is_within_allowed_write_paths(subpath, allowed_write_paths) {
if fs::canonicalize(subpath).is_err() {
append_bwrap_mount_point_read_only_bind_args(args, cleanup_mount_points, subpath);
return;
}
args.push("--ro-bind".to_string());
args.push(path_to_string(subpath));
args.push(path_to_string(subpath));
@@ -1156,9 +1160,10 @@ mod tests {
]);
let args = create_filesystem_args(&policy, temp_dir.path()).expect("filesystem args");
assert_eq!(
args.cleanup_mount_points,
vec![first_missing_component.clone()]
assert!(
args.cleanup_mount_points.contains(&first_missing_component),
"missing protected subtree should be registered for cleanup: {:#?}",
args.cleanup_mount_points
);
let first_missing_component = path_to_string(&first_missing_component);
let protected_path = path_to_string(&protected_path);