mirror of
https://github.com/openai/codex.git
synced 2026-08-29 14:09:35 +00:00
4f1992732c
## Why Sandbox wrappers replaced the process launch command and did not carry an `ExecParams.arg0` override through to the inner process. ## What changed - Route sandboxed Unix launches with a custom `arg0` through a helper mode that re-execs the requested program with the override. - Expose the helper executable to the filesystem sandbox and dispatch its mode from Codex and exec-server test binaries. ## Testing Add coverage for the prepared sandbox command and an end-to-end remote process that verifies both the custom `arg0` and filesystem restrictions. GitOrigin-RevId: c9f8eef3906d184e670184c2eeed250d5895a9ca
32 lines
857 B
Rust
32 lines
857 B
Rust
#[cfg(unix)]
|
|
use std::process::Command;
|
|
|
|
pub const CODEX_ARG0_EXEC_HELPER_ARG1: &str = "--codex-run-as-arg0-exec-helper";
|
|
|
|
#[cfg(unix)]
|
|
pub fn main() -> ! {
|
|
use std::os::unix::process::CommandExt;
|
|
|
|
let mut args = std::env::args_os();
|
|
let _program = args.next();
|
|
let _helper_mode = args.next();
|
|
let Some(arg0) = args.next() else {
|
|
eprintln!("missing arg0 for exec helper");
|
|
std::process::exit(1);
|
|
};
|
|
let Some(program) = args.next() else {
|
|
eprintln!("missing program for exec helper");
|
|
std::process::exit(1);
|
|
};
|
|
|
|
let error = Command::new(&program).arg0(arg0).args(args).exec();
|
|
eprintln!("failed to exec {program:?}: {error}");
|
|
std::process::exit(1);
|
|
}
|
|
|
|
#[cfg(not(unix))]
|
|
pub fn main() -> ! {
|
|
eprintln!("arg0 exec helper is only supported on Unix");
|
|
std::process::exit(1);
|
|
}
|