ci: satisfy clippy for Linux sandbox smoke

Co-authored-by: Codex <noreply@openai.com>

.github/workflows/README.md

@@ -13,6 +13,10 @@ The workflows in this directory are split so that pull requests get fast, review
   - `cargo shear`
   - `argument-comment-lint` on Linux, macOS, and Windows
   - `tools/argument-comment-lint` package tests when the lint or its workflow wiring changes
+- `linux-sandbox-smoke.yml` is an explicit host-policy smoke test for Linux
+  sandboxing. It installs Ubuntu's `bubblewrap` and AppArmor profiles on the
+  runner, then runs `codex exec` once with the default bwrap path and once with
+  `use_legacy_landlock=true`.
 
 ## Post-Merge On `main`
 

.github/workflows/linux-sandbox-smoke.yml

@@ -0,0 +1,119 @@
+name: Linux sandbox smoke
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/linux-sandbox-smoke.yml"
+      - "codex-rs/**"
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/linux-sandbox-smoke.yml"
+      - "codex-rs/**"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}::${{ github.event.pull_request.number > 0 && format('pr-{0}', github.event.pull_request.number) || github.ref_name }}${{ github.ref_name == 'main' && format('::{0}', github.run_id) || '' }}
+  cancel-in-progress: ${{ github.ref_name != 'main' }}
+
+jobs:
+  codex_exec:
+    name: codex exec sandbox modes
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - uses: dtolnay/rust-toolchain@a0b273b48ed29de4470960879e8381ff45632f26 # 1.93.0
+
+      - name: Install host sandbox dependencies
+        shell: bash
+        run: |
+          set -euo pipefail
+          sudo apt-get update -y
+          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+            apparmor \
+            apparmor-profiles \
+            apparmor-utils \
+            bubblewrap \
+            libcap-dev \
+            pkg-config
+
+      - name: Check host sandbox policy
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          bwrap="$(command -v bwrap)"
+          bwrap_real="$(readlink -f "$bwrap")"
+          echo "bwrap=$bwrap_real"
+          if [[ "$bwrap_real" != "/usr/bin/bwrap" ]]; then
+            echo "Expected apt-installed bubblewrap at /usr/bin/bwrap."
+            exit 1
+          fi
+          bwrap --version
+
+          runner_seccomp="$(grep '^Seccomp:' /proc/self/status | tr -s '[:space:]' ' ' | cut -d' ' -f2)"
+          echo "runner.seccomp=$runner_seccomp"
+          if [[ "$runner_seccomp" != "0" ]]; then
+            echo "Linux workers must not run under an extra outer seccomp filter."
+            exit 1
+          fi
+
+          if [[ ! -r /sys/module/apparmor/parameters/enabled ]]; then
+            echo "AppArmor module status is unavailable on this Linux worker."
+            exit 1
+          fi
+          apparmor_enabled="$(cat /sys/module/apparmor/parameters/enabled)"
+          echo "apparmor.enabled=$apparmor_enabled"
+          if [[ "$apparmor_enabled" != "Y" ]]; then
+            echo "AppArmor must be enabled for the Linux sandbox smoke test."
+            exit 1
+          fi
+
+          if ! apparmor_userns="$(sysctl -n kernel.apparmor_restrict_unprivileged_userns 2>/dev/null)"; then
+            echo "kernel.apparmor_restrict_unprivileged_userns is unavailable on this Linux worker."
+            exit 1
+          fi
+          echo "kernel.apparmor_restrict_unprivileged_userns=$apparmor_userns"
+          if [[ "$apparmor_userns" == "0" ]]; then
+            echo "AppArmor user namespace restrictions must stay enabled; do not disable them in CI."
+            exit 1
+          fi
+
+          if userns_clone="$(sysctl -n kernel.unprivileged_userns_clone 2>/dev/null)"; then
+            echo "kernel.unprivileged_userns_clone=$userns_clone"
+            if [[ "$userns_clone" != "1" ]]; then
+              echo "Linux workers must enable unprivileged user namespaces in the base image."
+              exit 1
+            fi
+          fi
+
+          profile_source="/usr/share/apparmor/extra-profiles/bwrap-userns-restrict"
+          profile_target="/etc/apparmor.d/bwrap-userns-restrict"
+          if [[ ! -r "$profile_source" ]]; then
+            echo "Ubuntu's bwrap-userns-restrict AppArmor profile is missing."
+            dpkg -L apparmor-profiles | grep bwrap || true
+            exit 1
+          fi
+
+          sudo ln -sf "$profile_source" "$profile_target"
+          sudo apparmor_parser -r "$profile_target"
+          if ! sudo grep -Eq '^bwrap \(enforce\)$' /sys/kernel/security/apparmor/profiles; then
+            echo "Ubuntu's bwrap AppArmor profile is not loaded in enforce mode."
+            sudo grep bwrap /sys/kernel/security/apparmor/profiles || true
+            exit 1
+          fi
+          if ! sudo grep -Eq '(^bwrap//.*unpriv_bwrap \(enforce\)$|^unpriv_bwrap \(enforce\)$)' /sys/kernel/security/apparmor/profiles; then
+            echo "Ubuntu's unprivileged bwrap child profile is not loaded in enforce mode."
+            sudo grep bwrap /sys/kernel/security/apparmor/profiles || true
+            exit 1
+          fi
+
+      - name: Smoke test codex exec sandbox modes
+        working-directory: codex-rs
+        env:
+          CODEX_LINUX_SANDBOX_SMOKE: 1
+          RUST_BACKTRACE: 1
+        run: cargo test -p codex-exec --test all -- linux_sandbox_smoke --nocapture

codex-rs/exec/tests/suite/linux_sandbox_smoke.rs

@@ -0,0 +1,150 @@
+#![cfg(target_os = "linux")]
+
+use anyhow::Context as _;
+use core_test_support::responses;
+use core_test_support::responses::ev_assistant_message;
+use core_test_support::responses::ev_completed;
+use core_test_support::responses::ev_function_call;
+use core_test_support::responses::ev_response_created;
+use core_test_support::responses::mount_sse_once;
+use core_test_support::responses::sse;
+use core_test_support::test_codex_exec::test_codex_exec;
+use pretty_assertions::assert_eq;
+use serde_json::Value;
+use serde_json::json;
+
+const SMOKE_ENV: &str = "CODEX_LINUX_SANDBOX_SMOKE";
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn linux_sandbox_smoke_codex_exec_uses_distro_bwrap() -> anyhow::Result<()> {
+    run_codex_exec_linux_sandbox_smoke(
+        /*use_legacy_landlock*/ false,
+        "call-bwrap-smoke",
+        ".codex-bwrap-smoke",
+        BWRAP_PROBE_SCRIPT,
+        "smoke.ok=bwrap",
+    )
+    .await
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn linux_sandbox_smoke_codex_exec_uses_legacy_landlock() -> anyhow::Result<()> {
+    run_codex_exec_linux_sandbox_smoke(
+        /*use_legacy_landlock*/ true,
+        "call-legacy-landlock-smoke",
+        ".codex-legacy-landlock-smoke",
+        LEGACY_LANDLOCK_PROBE_SCRIPT,
+        "smoke.ok=legacy-landlock",
+    )
+    .await
+}
+
+async fn run_codex_exec_linux_sandbox_smoke(
+    use_legacy_landlock: bool,
+    call_id: &str,
+    smoke_file: &str,
+    script: &str,
+    expected_marker: &str,
+) -> anyhow::Result<()> {
+    if std::env::var_os(SMOKE_ENV).is_none() {
+        eprintln!("Skipping Linux sandbox smoke test: set {SMOKE_ENV}=1 to enable.");
+        return Ok(());
+    }
+
+    let test = test_codex_exec();
+    let server = responses::start_mock_server().await;
+    let args = json!({
+        "command": script,
+        "timeout_ms": 10_000_u64,
+    });
+    mount_sse_once(
+        &server,
+        sse(vec![
+            ev_response_created("resp-1"),
+            ev_function_call(call_id, "shell_command", &serde_json::to_string(&args)?),
+            ev_completed("resp-1"),
+        ]),
+    )
+    .await;
+    let results_mock = mount_sse_once(
+        &server,
+        sse(vec![
+            ev_assistant_message("msg-1", "done"),
+            ev_completed("resp-2"),
+        ]),
+    )
+    .await;
+
+    let mut cmd = test.cmd_with_server(&server);
+    cmd.arg("--skip-git-repo-check").arg("--full-auto");
+    if use_legacy_landlock {
+        cmd.arg("-c").arg("use_legacy_landlock=true");
+    }
+    cmd.arg("run linux sandbox smoke").assert().success();
+
+    let output = results_mock
+        .single_request()
+        .function_call_output(call_id)
+        .get("output")
+        .and_then(Value::as_str)
+        .context("shell command output should be a string")?
+        .to_string();
+    assert!(
+        output.contains(expected_marker),
+        "shell command output missing {expected_marker:?}: {output}"
+    );
+    assert_eq!(
+        std::fs::read_to_string(test.cwd_path().join(smoke_file))?,
+        "ok"
+    );
+    Ok(())
+}
+
+const BWRAP_PROBE_SCRIPT: &str = r#"
+set -euo pipefail
+
+aa_profile="$(cat /proc/self/attr/current)"
+echo "payload.apparmor=$aa_profile"
+case "$aa_profile" in
+  *unpriv_bwrap*) ;;
+  *)
+    echo "Expected payload to run under Ubuntu's unprivileged bwrap AppArmor profile." >&2
+    exit 1
+    ;;
+esac
+
+seccomp_mode="$(grep '^Seccomp:' /proc/self/status | tr -s '[:space:]' ' ' | cut -d' ' -f2)"
+echo "payload.seccomp=$seccomp_mode"
+if [[ "$seccomp_mode" != "2" ]]; then
+  echo "Expected Codex to install a seccomp filter in the sandbox payload." >&2
+  exit 1
+fi
+
+printf ok > .codex-bwrap-smoke
+test "$(cat .codex-bwrap-smoke)" = ok
+echo "smoke.ok=bwrap"
+"#;
+
+const LEGACY_LANDLOCK_PROBE_SCRIPT: &str = r#"
+set -euo pipefail
+
+aa_profile="$(cat /proc/self/attr/current)"
+echo "payload.apparmor=$aa_profile"
+case "$aa_profile" in
+  *unpriv_bwrap*)
+    echo "Expected legacy Landlock smoke to avoid the bwrap AppArmor profile." >&2
+    exit 1
+    ;;
+esac
+
+seccomp_mode="$(grep '^Seccomp:' /proc/self/status | tr -s '[:space:]' ' ' | cut -d' ' -f2)"
+echo "payload.seccomp=$seccomp_mode"
+if [[ "$seccomp_mode" != "2" ]]; then
+  echo "Expected Codex to install a seccomp filter in the sandbox payload." >&2
+  exit 1
+fi
+
+printf ok > .codex-legacy-landlock-smoke
+test "$(cat .codex-legacy-landlock-smoke)" = ok
+echo "smoke.ok=legacy-landlock"
+"#;

codex-rs/exec/tests/suite/mod.rs

@@ -3,6 +3,7 @@ mod add_dir;
 mod apply_patch;
 mod auth_env;
 mod ephemeral;
+mod linux_sandbox_smoke;
 mod mcp_required_exit;
 mod originator;
 mod output_schema;