From fe5db40c71f12d703f52c2c9256df3f979ced63a Mon Sep 17 00:00:00 2001
From: viyatb-oai <viyatb@openai.com>
Date: Fri, 17 Apr 2026 13:47:57 -0700
Subject: [PATCH] ci: match Ubuntu unprivileged bwrap profile

---
 .github/workflows/linux-sandbox-smoke.yml        | 2 +-
 codex-rs/exec/tests/suite/linux_sandbox_smoke.rs | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/linux-sandbox-smoke.yml b/.github/workflows/linux-sandbox-smoke.yml
index a356de91b9..b1aec48491 100644
--- a/.github/workflows/linux-sandbox-smoke.yml
+++ b/.github/workflows/linux-sandbox-smoke.yml
@@ -105,7 +105,7 @@ jobs:
             sudo grep bwrap /sys/kernel/security/apparmor/profiles || true
             exit 1
           fi
-          if ! sudo grep -Eq '^bwrap//.*unpriv_bwrap \(enforce\)$' /sys/kernel/security/apparmor/profiles; then
+          if ! sudo grep -Eq '(^bwrap//.*unpriv_bwrap \(enforce\)$|^unpriv_bwrap \(enforce\)$)' /sys/kernel/security/apparmor/profiles; then
             echo "Ubuntu's unprivileged bwrap child profile is not loaded in enforce mode."
             sudo grep bwrap /sys/kernel/security/apparmor/profiles || true
             exit 1
diff --git a/codex-rs/exec/tests/suite/linux_sandbox_smoke.rs b/codex-rs/exec/tests/suite/linux_sandbox_smoke.rs
index 276c261e21..c85ea77db5 100644
--- a/codex-rs/exec/tests/suite/linux_sandbox_smoke.rs
+++ b/codex-rs/exec/tests/suite/linux_sandbox_smoke.rs
@@ -106,7 +106,7 @@ set -euo pipefail
 aa_profile="$(cat /proc/self/attr/current)"
 echo "payload.apparmor=$aa_profile"
 case "$aa_profile" in
-  *bwrap*unpriv_bwrap*) ;;
+  *unpriv_bwrap*) ;;
   *)
     echo "Expected payload to run under Ubuntu's unprivileged bwrap AppArmor profile." >&2
     exit 1
@@ -131,7 +131,7 @@ set -euo pipefail
 aa_profile="$(cat /proc/self/attr/current)"
 echo "payload.apparmor=$aa_profile"
 case "$aa_profile" in
-  *bwrap*unpriv_bwrap*)
+  *unpriv_bwrap*)
     echo "Expected legacy Landlock smoke to avoid the bwrap AppArmor profile." >&2
     exit 1
     ;;