mirror of
https://github.com/openai/codex.git
synced 2026-11-08 20:40:33 +00:00
iceweasel-oai
2a32e7c963
## What changed Replace external `rg` scans and the fallback walker with an in-process `ignore` walker for bubblewrap deny-glob expansion. Remove scanner lookup and dependency tracking from sandbox integrity checks. Include hidden and ignored files, respect scan depth limits, and fail closed on traversal errors. Anchor patterns to their static search roots and preserve literal leading `#`, leading `!`, trailing spaces, and unclosed character classes. Follow explicit symlink roots while skipping child symlinks, and mask canonical targets of matched paths. ## Testing Extend unit and sandbox integration coverage for glob syntax, depth limits, traversal failures, symlink handling, commands launched from `/`, and operation without executing `rg`. GitOrigin-RevId: 1767d7f37acb149457642bf24ee5971a28696438
49 lines
1.2 KiB
Rust
49 lines
1.2 KiB
Rust
//! Linux sandbox helper entry point.
|
|
//!
|
|
//! On Linux, `codex-linux-sandbox` applies:
|
|
//! - in-process restrictions (`no_new_privs` + seccomp), and
|
|
//! - bubblewrap for filesystem isolation.
|
|
#[cfg(target_os = "linux")]
|
|
mod bazel_bwrap;
|
|
#[cfg(target_os = "linux")]
|
|
mod bundled_bwrap;
|
|
#[cfg(target_os = "linux")]
|
|
mod bwrap;
|
|
#[cfg(target_os = "linux")]
|
|
mod daemon_mounts;
|
|
#[cfg(target_os = "linux")]
|
|
mod exec_util;
|
|
#[cfg(target_os = "linux")]
|
|
mod fd_mount;
|
|
#[cfg(target_os = "linux")]
|
|
mod launcher;
|
|
#[cfg(target_os = "linux")]
|
|
mod linux_run_main;
|
|
#[cfg(target_os = "linux")]
|
|
mod proxy_lifecycle;
|
|
#[cfg(target_os = "linux")]
|
|
mod proxy_routing;
|
|
#[cfg(target_os = "linux")]
|
|
mod seccomp;
|
|
#[cfg(target_os = "linux")]
|
|
mod wslg;
|
|
|
|
#[cfg(target_os = "linux")]
|
|
pub use bundled_bwrap::find_bundled_bwrap_for_exe;
|
|
#[cfg(target_os = "linux")]
|
|
pub use bwrap::expand_unreadable_globs;
|
|
|
|
/// Exit status returned when bundled bubblewrap fails digest verification.
|
|
#[cfg(target_os = "linux")]
|
|
pub const BUNDLED_BWRAP_DIGEST_VERIFICATION_FAILURE_EXIT_CODE: i32 = 8;
|
|
|
|
#[cfg(target_os = "linux")]
|
|
pub fn run_main() -> ! {
|
|
linux_run_main::run_main();
|
|
}
|
|
|
|
#[cfg(not(target_os = "linux"))]
|
|
pub fn run_main() -> ! {
|
|
panic!("codex-linux-sandbox is only supported on Linux");
|
|
}
|