openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-09-07 15:40:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(sandboxing): avoid PATH fallback in bwrap probe

Browse Source 
Co-authored-by: Codex noreply@openai.com
This commit is contained in:
viyatb-oai
2026-06-23 22:48:03 -07:00
parent 72f161e41c
commit dcdfe68e95
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
codex-rs/sandboxing/src/bwrap.rs
View File

@@ -117,6 +117,9 @@ fn probe_system_bwrap(
timeout: Duration,
unshare_network: bool,
) -> SystemBwrapProbeResult {
let Some(true_command) = resolve_true_command() else {
return SystemBwrapProbeResult::Failed;
};
let mut command = Command::new(system_bwrap_path);
command.arg("--unshare-user");
if unshare_network {
@@ -124,7 +127,7 @@ fn probe_system_bwrap(
}
command
.args(["--ro-bind", "/", "/"])
.arg(resolve_true_command())
.arg(true_command)
.stdout(Stdio::null())
.stderr(Stdio::piped());
let deadline = Instant::now() + timeout;
@@ -207,11 +210,10 @@ fn read_available_probe_stderr(stderr: &mut ChildStderr, bytes: &mut Vec<u8>) {
}
}
fn resolve_true_command() -> &'static str {
fn resolve_true_command() -> Option<&'static str> {
["/usr/bin/true", "/bin/true"]
.into_iter()
.find(|candidate| Path::new(candidate).exists())
.unwrap_or("true")
}
pub(crate) fn is_wsl1() -> bool {