openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-09 20:50:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Mitigate Windows sandbox helper elevation heuristic

Browse Source
This commit is contained in:
David Wiesen
2026-06-05 09:10:52 -07:00
parent 55aa071b17
commit cd2e03d540
5 changed files with 19 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/core/tests/suite/windows_sandbox.rs
+6 -3
View File
@@ -91,9 +91,12 @@ fn stage_windows_sandbox_helpers() -> anyhow::Result<()> {
.with_context(|| format!("create resources dir {}", resources_dir.display()));
}
}
for helper_name in ["codex-windows-sandbox-setup", "codex-command-runner"] {
let helper = codex_utils_cargo_bin::cargo_bin(helper_name)?;
let file_name = Path::new(helper_name).with_extension("exe");
for (cargo_bin_name, file_name) in [
("codex-windows-sandbox-setup", "codex-windows-sandbox-helper.exe"),
("codex-command-runner", "codex-command-runner.exe"),
] {
let helper = codex_utils_cargo_bin::cargo_bin(cargo_bin_name)?;
let file_name = Path::new(file_name);
let destination = resources_dir.join(file_name);
if let Err(err) = std::fs::copy(&helper, &destination) {
// A sandbox helper can briefly remain alive after the sandboxed
codex-rs/windows-sandbox-rs/src/setup.rs
+6 -2
View File
@@ -46,7 +46,10 @@ pub const ONLINE_USERNAME: &str = "CodexSandboxOnline";
const ERROR_CANCELLED: u32 = 1223;
const SECURITY_BUILTIN_DOMAIN_RID: u32 = 0x0000_0020;
const DOMAIN_ALIAS_RID_ADMINS: u32 = 0x0000_0220;
const SETUP_EXE_FILENAME: &str = "codex-windows-sandbox-setup.exe";
// Avoid "setup.exe" on disk because Windows installer detection can flag that
// filename in per-user caches and force an elevation prompt.
const SETUP_EXE_FILENAME: &str = "codex-windows-sandbox-helper.exe";
const LEGACY_SETUP_EXE_FILENAME: &str = "codex-windows-sandbox-setup.exe";
const USERPROFILE_ROOT_EXCLUSIONS: &[&str] = &[
".ssh",
".tsh",
@@ -673,6 +676,7 @@ fn find_setup_exe() -> PathBuf {
fn find_setup_exe_for_current_exe(exe: &Path) -> Option<PathBuf> {
bundled_executable_path_for_exe(exe, SETUP_EXE_FILENAME)
.or_else(|| bundled_executable_path_for_exe(exe, LEGACY_SETUP_EXE_FILENAME))
}
fn report_helper_failure(
@@ -1290,7 +1294,7 @@ mod tests {
fs::create_dir_all(&bin_dir).expect("create bin dir");
fs::create_dir_all(&resources_dir).expect("create resources dir");
let exe = bin_dir.join("codex.exe");
let setup_exe = resources_dir.join("codex-windows-sandbox-setup.exe");
let setup_exe = resources_dir.join("codex-windows-sandbox-helper.exe");
fs::write(&exe, b"codex").expect("write exe");
fs::write(&setup_exe, b"setup").expect("write setup");