mirror of
https://github.com/openai/codex.git
synced 2026-04-25 07:05:38 +00:00
abbd74e2be
`SandboxPolicy::ReadOnly` previously implied broad read access and could
not express a narrower read surface.
This change introduces an explicit read-access model so we can support
user-configurable read restrictions in follow-up work, while preserving
current behavior today.
It also ensures unsupported backends fail closed for restricted-read
policies instead of silently granting broader access than intended.
## What
- Added `ReadOnlyAccess` in protocol with:
- `Restricted { include_platform_defaults, readable_roots }`
- `FullAccess`
- Updated `SandboxPolicy` to carry read-access configuration:
- `ReadOnly { access: ReadOnlyAccess }`
- `WorkspaceWrite { ..., read_only_access: ReadOnlyAccess }`
- Preserved existing behavior by defaulting current construction paths
to `ReadOnlyAccess::FullAccess`.
- Threaded the new fields through sandbox policy consumers and call
sites across `core`, `tui`, `linux-sandbox`, `windows-sandbox`, and
related tests.
- Updated Seatbelt policy generation to honor restricted read roots by
emitting scoped read rules when full read access is not granted.
- Added fail-closed behavior on Linux and Windows backends when
restricted read access is requested but not yet implemented there
(`UnsupportedOperation`).
- Regenerated app-server protocol schema and TypeScript artifacts,
including `ReadOnlyAccess`.
## Compatibility / rollout
- Runtime behavior remains unchanged by default (`FullAccess`).
- API/schema changes are in place so future config wiring can enable
restricted read access without another policy-shape migration.
214 lines
5.1 KiB
JSON
214 lines
5.1 KiB
JSON
{
|
|
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
"definitions": {
|
|
"AbsolutePathBuf": {
|
|
"description": "A path that is guaranteed to be absolute and normalized (though it is not guaranteed to be canonicalized or exist on the filesystem).\n\nIMPORTANT: When deserializing an `AbsolutePathBuf`, a base path must be set using [AbsolutePathBufGuard::new]. If no base path is set, the deserialization will fail unless the path being deserialized is already absolute.",
|
|
"type": "string"
|
|
},
|
|
"NetworkAccess": {
|
|
"enum": [
|
|
"restricted",
|
|
"enabled"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"ReadOnlyAccess": {
|
|
"oneOf": [
|
|
{
|
|
"properties": {
|
|
"includePlatformDefaults": {
|
|
"default": true,
|
|
"type": "boolean"
|
|
},
|
|
"readableRoots": {
|
|
"default": [],
|
|
"items": {
|
|
"$ref": "#/definitions/AbsolutePathBuf"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"restricted"
|
|
],
|
|
"title": "RestrictedReadOnlyAccessType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"type"
|
|
],
|
|
"title": "RestrictedReadOnlyAccess",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"type": {
|
|
"enum": [
|
|
"fullAccess"
|
|
],
|
|
"title": "FullAccessReadOnlyAccessType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"type"
|
|
],
|
|
"title": "FullAccessReadOnlyAccess",
|
|
"type": "object"
|
|
}
|
|
]
|
|
},
|
|
"SandboxPolicy": {
|
|
"oneOf": [
|
|
{
|
|
"properties": {
|
|
"type": {
|
|
"enum": [
|
|
"dangerFullAccess"
|
|
],
|
|
"title": "DangerFullAccessSandboxPolicyType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"type"
|
|
],
|
|
"title": "DangerFullAccessSandboxPolicy",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"access": {
|
|
"allOf": [
|
|
{
|
|
"$ref": "#/definitions/ReadOnlyAccess"
|
|
}
|
|
],
|
|
"default": {
|
|
"type": "fullAccess"
|
|
}
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"readOnly"
|
|
],
|
|
"title": "ReadOnlySandboxPolicyType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"type"
|
|
],
|
|
"title": "ReadOnlySandboxPolicy",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"networkAccess": {
|
|
"allOf": [
|
|
{
|
|
"$ref": "#/definitions/NetworkAccess"
|
|
}
|
|
],
|
|
"default": "restricted"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"externalSandbox"
|
|
],
|
|
"title": "ExternalSandboxSandboxPolicyType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"type"
|
|
],
|
|
"title": "ExternalSandboxSandboxPolicy",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"excludeSlashTmp": {
|
|
"default": false,
|
|
"type": "boolean"
|
|
},
|
|
"excludeTmpdirEnvVar": {
|
|
"default": false,
|
|
"type": "boolean"
|
|
},
|
|
"networkAccess": {
|
|
"default": false,
|
|
"type": "boolean"
|
|
},
|
|
"readOnlyAccess": {
|
|
"allOf": [
|
|
{
|
|
"$ref": "#/definitions/ReadOnlyAccess"
|
|
}
|
|
],
|
|
"default": {
|
|
"type": "fullAccess"
|
|
}
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"workspaceWrite"
|
|
],
|
|
"title": "WorkspaceWriteSandboxPolicyType",
|
|
"type": "string"
|
|
},
|
|
"writableRoots": {
|
|
"default": [],
|
|
"items": {
|
|
"$ref": "#/definitions/AbsolutePathBuf"
|
|
},
|
|
"type": "array"
|
|
}
|
|
},
|
|
"required": [
|
|
"type"
|
|
],
|
|
"title": "WorkspaceWriteSandboxPolicy",
|
|
"type": "object"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"properties": {
|
|
"command": {
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"cwd": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"sandboxPolicy": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/SandboxPolicy"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"timeoutMs": {
|
|
"format": "int64",
|
|
"type": [
|
|
"integer",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"command"
|
|
],
|
|
"title": "CommandExecParams",
|
|
"type": "object"
|
|
} |