mirror of
https://github.com/openai/codex.git
synced 2026-09-20 12:47:38 +00:00
49305d74b4
## Why Network access and Unix-socket allowlists must not let commands with filesystem restrictions reach the privileged app-server RPC transport. ## What changed - Bind Unix control sockets in a fixed, user-owned directory with mode `0700`, independent of environment settings, and expose the advertised paths as symlinks. Preserve existing parent permissions, reject unsafe parents, and serialize socket setup and publication. - Mask the socket directory in Linux bubblewrap sandboxes after each bind that exposes it. Reject host mount aliases and nested mounts that compromise isolation. - Deny access to the directory and outbound connections to its sockets in macOS Seatbelt policies, including when network access or Unix-socket allowlists grant broader access. - Require bubblewrap for filesystem-restricted Linux execution. Users with `features.use_legacy_landlock` enabled must disable it for these policies. ## Testing Add regression coverage for direct and symlink socket access, hardlink attempts, Linux host-process links and bind-mount aliases, and continued use of unrelated and sandbox-local sockets. Add transport coverage for parent permissions, concurrent restart after a stale symlink, and cleanup that preserves a replacement at the advertised path. GitOrigin-RevId: 53372c27eea278d964f2cf68aed24323ef3b7082
44 lines
1.1 KiB
Rust
44 lines
1.1 KiB
Rust
//! Linux sandbox helper entry point.
|
|
//!
|
|
//! On Linux, `codex-linux-sandbox` applies:
|
|
//! - in-process restrictions (`no_new_privs` + seccomp), and
|
|
//! - bubblewrap for filesystem isolation.
|
|
#[cfg(target_os = "linux")]
|
|
mod bazel_bwrap;
|
|
#[cfg(target_os = "linux")]
|
|
mod bundled_bwrap;
|
|
#[cfg(target_os = "linux")]
|
|
mod bwrap;
|
|
#[cfg(target_os = "linux")]
|
|
mod daemon_mounts;
|
|
#[cfg(target_os = "linux")]
|
|
mod exec_util;
|
|
#[cfg(target_os = "linux")]
|
|
mod fd_mount;
|
|
#[cfg(target_os = "linux")]
|
|
mod landlock;
|
|
#[cfg(target_os = "linux")]
|
|
mod launcher;
|
|
#[cfg(target_os = "linux")]
|
|
mod linux_run_main;
|
|
#[cfg(target_os = "linux")]
|
|
mod proxy_lifecycle;
|
|
#[cfg(target_os = "linux")]
|
|
mod proxy_routing;
|
|
#[cfg(target_os = "linux")]
|
|
mod wslg;
|
|
|
|
/// Exit status returned when bundled bubblewrap fails digest verification.
|
|
#[cfg(target_os = "linux")]
|
|
pub const BUNDLED_BWRAP_DIGEST_VERIFICATION_FAILURE_EXIT_CODE: i32 = 8;
|
|
|
|
#[cfg(target_os = "linux")]
|
|
pub fn run_main() -> ! {
|
|
linux_run_main::run_main();
|
|
}
|
|
|
|
#[cfg(not(target_os = "linux"))]
|
|
pub fn run_main() -> ! {
|
|
panic!("codex-linux-sandbox is only supported on Linux");
|
|
}
|