viyatb-oai c5eb33aed1 Harden managed proxy setup for sandboxed executions (#34641) ...

## What changed

- Make the generated Linux proxy socket directory readable inside restricted
  `bubblewrap` sandboxes so the proxy bridge can connect.
- Route `WS_PROXY` and `WSS_PROXY` through the Linux managed proxy bridge.
- Remove inherited proxy attribution tokens from unscoped executions while
  continuing to replace them with the current token for scoped executions.

## Testing

- Exercise `WSS_PROXY` routing with a minimal filesystem policy.
- Cover attribution-token removal and replacement during environment setup.

GitOrigin-RevId: 2f14ddb26baab0147a786bc354d93eb5aad059f3

2026-07-22 00:31:30 +00:00

..

bazel_bwrap.rs

linux-sandbox: use standalone bundled bwrap (#21255)

2026-05-05 17:14:29 -07:00

bundled_bwrap.rs

runtime: use install context for bundled bwrap (#23634)

2026-05-20 08:24:43 -07:00

bwrap.rs

Skip missing paths in filesystem sandbox entries (#34598)

2026-07-21 19:17:18 +00:00

exec_util.rs

linux-sandbox: use standalone bundled bwrap (#21255)

2026-05-05 17:14:29 -07:00

landlock.rs

[codex] Allow socketpair in proxy-routed Linux sandbox (#26625)

2026-06-05 09:34:36 -07:00

launcher.rs

linux-sandbox: use standalone bundled bwrap (#21255)

2026-05-05 17:14:29 -07:00

lib.rs

linux-sandbox: use standalone bundled bwrap (#21255)

2026-05-05 17:14:29 -07:00

linux_run_main_tests.rs

Skip missing paths in filesystem sandbox entries (#34598)

2026-07-21 19:17:18 +00:00

linux_run_main.rs

Harden managed proxy setup for sandboxed executions (#34641)

2026-07-22 00:31:30 +00:00

main.rs

fix: overhaul how we spawn commands under seccomp/landlock on Linux (#1086)

2025-05-23 11:37:07 -07:00

proxy_routing.rs

Harden managed proxy setup for sandboxed executions (#34641)

2026-07-22 00:31:30 +00:00