mirror of
https://github.com/openai/codex.git
synced 2026-10-26 18:38:47 +00:00
Michael Bolin
9c0eced391
## Why Shell escalation still has adapter code that expects a legacy sandbox policy, but command approvals should carry the resolved `PermissionProfile` so callers can reason about the granted permissions canonically. ## What changed This introduces profile-shaped resolved escalation permissions while retaining the derived legacy sandbox policy for the Unix escalation adapter. It updates approval types, the escalation server protocol, and tests that inspect escalated command permissions. ## Verification - `cargo test -p codex-core --test all handle_container_exec_ -- --nocapture` - `cargo test -p codex-core --test all handle_sandbox_ -- --nocapture` --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/openai/codex/pull/18287). * #18288 * __->__ #18287
80 lines
2.9 KiB
Rust
80 lines
2.9 KiB
Rust
//! Unix shell-escalation protocol implementation.
|
|
//!
|
|
//! A patched shell invokes an exec wrapper on every `exec()` attempt. The wrapper sends an
|
|
//! `EscalateRequest` over the inherited `CODEX_ESCALATE_SOCKET`, and the server decides whether to
|
|
//! run the command directly (`Run`) or execute it on the server side (`Escalate`).
|
|
//!
|
|
//! Of key importance is the `EscalateRequest` includes a file descriptor for a socket
|
|
//! that the server can use to send the response to the execve wrapper. In this
|
|
//! way, all descendents of the Server process can use the file descriptor
|
|
//! specified by the `CODEX_ESCALATE_SOCKET` environment variable to _send_ escalation requests,
|
|
//! but responses are read from a separate socket that is created for each request, which
|
|
//! allows the server to handle multiple concurrent escalation requests.
|
|
//!
|
|
//! ### Escalation flow
|
|
//!
|
|
//! Command Server Shell Execve Wrapper
|
|
//! |
|
|
//! o----->o
|
|
//! | |
|
|
//! | o--(exec)-->o
|
|
//! | | |
|
|
//! |o<-(EscalateReq)--o
|
|
//! || | |
|
|
//! |o--(Escalate)---->o
|
|
//! || | |
|
|
//! |o<---------(fds)--o
|
|
//! || | |
|
|
//! o<------o | |
|
|
//! | || | |
|
|
//! x------>o | |
|
|
//! || | |
|
|
//! |x--(exit code)--->o
|
|
//! | | |
|
|
//! | o<--(exit)--x
|
|
//! | |
|
|
//! o<-----x
|
|
//!
|
|
//! ### Non-escalation flow
|
|
//!
|
|
//! Server Shell Execve Wrapper Command
|
|
//! |
|
|
//! o----->o
|
|
//! | |
|
|
//! | o--(exec)-->o
|
|
//! | | |
|
|
//! |o<-(EscalateReq)--o
|
|
//! || | |
|
|
//! |o-(Run)---------->o
|
|
//! | | |
|
|
//! | | x--(exec)-->o
|
|
//! | | |
|
|
//! | o<--------------(exit)--x
|
|
//! | |
|
|
//! o<-----x
|
|
//!
|
|
pub(crate) mod escalate_client;
|
|
pub(crate) mod escalate_protocol;
|
|
pub(crate) mod escalate_server;
|
|
pub(crate) mod escalation_policy;
|
|
pub(crate) mod execve_wrapper;
|
|
pub(crate) mod socket;
|
|
pub(crate) mod stopwatch;
|
|
|
|
pub use self::escalate_client::run_shell_escalation_execve_wrapper;
|
|
pub use self::escalate_protocol::ESCALATE_SOCKET_ENV_VAR;
|
|
pub use self::escalate_protocol::EscalateAction;
|
|
pub use self::escalate_protocol::EscalationDecision;
|
|
pub use self::escalate_protocol::EscalationExecution;
|
|
pub use self::escalate_server::EscalateServer;
|
|
pub use self::escalate_server::EscalationSession;
|
|
pub use self::escalate_server::ExecParams;
|
|
pub use self::escalate_server::ExecResult;
|
|
pub use self::escalate_server::PreparedExec;
|
|
pub use self::escalate_server::ShellCommandExecutor;
|
|
pub use self::escalation_policy::EscalationPolicy;
|
|
pub use self::execve_wrapper::main_execve_wrapper;
|
|
pub use self::stopwatch::Stopwatch;
|
|
pub use codex_protocol::approvals::EscalationPermissions;
|
|
pub use codex_protocol::approvals::ResolvedPermissionProfile;
|