openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-09-08 15:50:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci: match Ubuntu unprivileged bwrap profile

Browse Source
This commit is contained in:
viyatb-oai
2026-04-17 13:47:57 -07:00
parent d091915dce
commit fe5db40c71
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.github/workflows/linux-sandbox-smoke.yml vendored
View File

@@ -105,7 +105,7 @@ jobs:
sudo grep bwrap /sys/kernel/security/apparmor/profiles || true
exit 1
fi
if ! sudo grep -Eq '^bwrap//.*unpriv_bwrap \(enforce\)$' /sys/kernel/security/apparmor/profiles; then
if ! sudo grep -Eq '(^bwrap//.*unpriv_bwrap \(enforce\)$|^unpriv_bwrap \(enforce\)$)' /sys/kernel/security/apparmor/profiles; then
echo "Ubuntu's unprivileged bwrap child profile is not loaded in enforce mode."
sudo grep bwrap /sys/kernel/security/apparmor/profiles || true
exit 1

4
codex-rs/exec/tests/suite/linux_sandbox_smoke.rs
View File

@@ -106,7 +106,7 @@ set -euo pipefail
aa_profile="$(cat /proc/self/attr/current)"
echo "payload.apparmor=$aa_profile"
case "$aa_profile" in
*bwrap*unpriv_bwrap*) ;;
*unpriv_bwrap*) ;;
*)
echo "Expected payload to run under Ubuntu's unprivileged bwrap AppArmor profile." >&2
exit 1
@@ -131,7 +131,7 @@ set -euo pipefail
aa_profile="$(cat /proc/self/attr/current)"
echo "payload.apparmor=$aa_profile"
case "$aa_profile" in
*bwrap*unpriv_bwrap*)
*unpriv_bwrap*)
echo "Expected legacy Landlock smoke to avoid the bwrap AppArmor profile." >&2
exit 1
;;