codex

mirror of https://github.com/openai/codex.git synced 2026-10-21 17:48:44 +00:00

Files

T

jif 1dac3d9ca0 Fail closed on unsafe Linux unreadable globs (#38026 )

## Why

Linux sandbox unreadable globs without a non-root directory prefix cannot be safely expanded because they would require scanning from `/`. Silently skipping these patterns leaves the requested deny-read rule unenforced.

## What changed

Return a fatal sandbox construction error when an unreadable glob cannot be split into a safe ripgrep search root. The error directs callers to use a pattern with a non-root directory prefix.

## Testing

Add a regression test confirming that `/**/*.env` rejects Bubblewrap command construction.

GitOrigin-RevId: 2f3cb398d39a9bc077d3a1b74e08dc506d239e60

2026-08-11 15:52:59 +00:00

bazel_bwrap.rs

linux-sandbox: use standalone bundled bwrap (#21255 )

2026-05-05 17:14:29 -07:00

bundled_bwrap.rs

runtime: use install context for bundled bwrap (#23634 )

2026-05-20 08:24:43 -07:00

bwrap.rs

Fail closed on unsafe Linux unreadable globs (#38026 )

2026-08-11 15:52:59 +00:00

exec_util.rs

linux-sandbox: use standalone bundled bwrap (#21255 )