openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-09 20:50:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: make .git read-only within a writable root when using Seatbelt

Browse Source
This commit is contained in:
Michael Bolin
2025-08-01 15:07:43 -07:00
parent 92f3566d78
commit bff6e1e6cd
7 changed files with 370 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/linux-sandbox/src/landlock.rs
+5 -1
View File
@@ -36,7 +36,11 @@ pub(crate) fn apply_sandbox_policy_to_current_thread(
}
if !sandbox_policy.has_full_disk_write_access() {
let writable_roots = sandbox_policy.get_writable_roots_with_cwd(cwd);
let writable_roots = sandbox_policy
.get_writable_roots_with_cwd(cwd)
.into_iter()
.map(|writable_root| writable_root.root)
.collect();
install_filesystem_landlock_rules_on_current_thread(writable_roots)?;
}