exec-server: expose process helper to outer sandbox#31937
Conversation
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9dc6b550bc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
0322c9c to
4b4cac2
Compare
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4b4cac29b5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
4b4cac2 to
aef7aac
Compare
| network: None, | ||
| sandbox_policy_cwd, | ||
| codex_linux_sandbox_exe: runtime_paths.codex_linux_sandbox_exe.as_deref(), | ||
| codex_linux_sandbox_exe: Some(runtime_paths.codex_self_exe.as_path()), |
There was a problem hiding this comment.
Can we keep using the configured helper here and add both executable paths to the readable roots? With codex_self_exe, the manager produces a bare codex-linux-sandbox argv0. The PTY launcher resolves that through the request PATH before the sandbox starts, so an empty PATH fails and a workspace binary with that name can run unsandboxed. This also breaks callers with a separate helper and the old-bwrap fallback. The fix is to restore runtime_paths.codex_linux_sandbox_exe.as_deref(), include both helper/self paths in the readable roots, and cover tty: true with a hostile PATH.
There was a problem hiding this comment.
ooof, yeah, this is a bad change.
51d3d61 to
273037f
Compare
Why
Sandboxed exec-server process requests can use a restricted filesystem profile that does not expose the exec-server binary. On Linux, the outer bubblewrap stage re-enters that binary with the
codex-linux-sandboxargv0 to install seccomp, so hiding the binary prevents the requested process from starting.What changed
codex_self_exeto the process permission profile before constructing the outer platform sandboxTest plan
just test -p codex-exec-server process_sandboxjust test -p codex-exec-server --test exec_process remote_process_keeps_sandbox_helper_visible_with_restricted_reads