viyatb-oai 5b80f87c97 fix(linux-sandbox): fall back when system bwrap lacks perms (#20628) ...

## Why

Codex `0.128` started using `--perms` in more routine Linux sandbox
construction when protected workspace metadata mounts landed in #19852.
Upstream bubblewrap added `--perms` in `v0.5.0`, so system `bwrap`
versions older than that, including the `v0.4.0` and `v0.4.1` family, do
not support the flag. The launcher still selected those binaries as long
as they existed on `PATH`.

That means affected hosts can fail every sandboxed command up front
with:

```text
bwrap: Unknown option --perms
```

The reports in #20590 and duplicate #20623 match that compatibility gap;
#20623 explicitly shows system bubblewrap `0.4.0`.

## What changed

- Replace the single `--argv0` probe with a small system-bwrap
capability probe in `codex-rs/linux-sandbox/src/launcher.rs`.
- Continue using the old-system `--argv0` compatibility path when
needed, but only select a system `bwrap` if it also advertises
`--perms`.
- Fall back to the vendored `bwrap` when the system binary is too old
for the flags Codex now requires.
- Add regression coverage for the old-system-bwrap case so binaries
without `--perms` stay on the vendored path.

## Verification

- Added `falls_back_to_vendored_when_system_bwrap_lacks_perms` to cover
the reported compatibility gap.
- Ran `cargo test -p codex-linux-sandbox` and `cargo clippy -p
codex-linux-sandbox --tests` locally. On macOS, the crate builds but its
Linux-only tests are cfg-gated out, so the new regression test still
needs Linux CI or a Linux devbox run for real execution coverage.

## Related issues

- Fixes #20590
- Duplicate report: #20623

2026-05-04 10:38:31 -07:00

..

common

fix(exec-server): retain output until streams close (#18946)

2026-04-23 19:49:58 +00:00

exec_process.rs

fix(exec-server): retain output until streams close (#18946)

2026-04-23 19:49:58 +00:00

file_system.rs

fix(linux-sandbox): fall back when system bwrap lacks perms (#20628)

2026-05-04 10:38:31 -07:00

http_client.rs

[2/4] Implement executor HTTP request runner (#18582)

2026-04-22 20:36:34 +00:00

http_request.rs

[2/4] Implement executor HTTP request runner (#18582)

2026-04-22 20:36:34 +00:00

initialize.rs

feat: move exec-server ownership (#16344)

2026-04-10 14:11:47 +01:00

process.rs

[2/8] Support piped stdin in exec process API (#18086)

2026-04-16 10:30:10 -07:00

websocket.rs

feat: move exec-server ownership (#16344)

2026-04-10 14:11:47 +01:00