mirror of
https://github.com/openai/codex.git
synced 2026-11-14 21:40:39 +00:00
viyatb-oai
7194b21776
## Why Native TCP clients need to reach managed network destinations without implementing proxy support themselves. ## What changed - Add `--transparent-tcp` to the Linux sandbox command, using a bundled TCP stack, private TUN interface, and DNS stub to route native IPv4 and IPv6 connections through the attributed managed SOCKS proxy. - Preserve original hostnames for proxy policy checks and cancel pending approval connections when their native sockets close. - Expose `--linux-sandbox-transparent-tcp` and `--tcp-upstream-proxy` on `codex exec-server` for transparent routing and a mandatory HTTP CONNECT next hop without direct fallback. - Require private network and PID namespaces, private procfs, system `bwrap`, and access to `/dev/net/tun`; reject incompatible launcher options and untrusted proxy ports. ## Testing Add integration coverage for native hostname and IPv6 connections, SOCKS attribution, pending connection cancellation, policy denials, and filesystem and host-loopback isolation. Extend launcher and executor tests for option validation and managed-policy propagation. GitOrigin-RevId: 96bd7726e5369efceb65320face56aa85ae3deb8
32 lines
756 B
Python
32 lines
756 B
Python
load("//:defs.bzl", "codex_rust_crate")
|
|
|
|
codex_rust_crate(
|
|
name = "linux-sandbox",
|
|
crate_name = "codex_linux_sandbox",
|
|
extra_binaries = [
|
|
"//codex-rs/bwrap:bwrap",
|
|
],
|
|
rustc_env_files = select({
|
|
"@platforms//os:linux": ["//codex-rs/bwrap:bwrap-sha256-env"],
|
|
"//conditions:default": [],
|
|
}),
|
|
test_data_extra = [":managed-tcp-test-data"],
|
|
)
|
|
|
|
config_setting(
|
|
name = "linux-x86_64",
|
|
constraint_values = [
|
|
"@platforms//cpu:x86_64",
|
|
"@platforms//os:linux",
|
|
],
|
|
)
|
|
|
|
filegroup(
|
|
name = "managed-tcp-test-data",
|
|
testonly = True,
|
|
srcs = select({
|
|
":linux-x86_64": ["@managed_tcp_test_bubblewrap_noble_amd64//:usr/bin/bwrap"],
|
|
"//conditions:default": [],
|
|
}),
|
|
)
|