mirror of
https://github.com/openai/codex.git
synced 2026-05-28 06:55:01 +00:00
f956cc2a02
## Summary Vendor Bubblewrap into the repo and add minimal build plumbing in `codex-linux-sandbox` to compile/link it. ## Why We want to move Linux sandboxing toward Bubblewrap, but in a safe two-step rollout: 1) vendoring/build setup (this PR), 2) runtime integration (follow-up PR). ## Included - Add `codex-rs/vendor/bubblewrap` sources. - Add build-time FFI path in `codex-rs/linux-sandbox`. - Update `build.rs` rerun tracking for vendored files. - Small vendored compile warning fix (`sockaddr_nl` full init). follow up in https://github.com/openai/codex/pull/9938
24 lines
580 B
Rust
24 lines
580 B
Rust
//! Linux sandbox helper entry point.
|
|
//!
|
|
//! On Linux, `codex-linux-sandbox` applies:
|
|
//! - in-process restrictions (`no_new_privs` + seccomp), and
|
|
//! - bubblewrap for filesystem isolation.
|
|
#[cfg(target_os = "linux")]
|
|
mod bwrap;
|
|
#[cfg(target_os = "linux")]
|
|
mod landlock;
|
|
#[cfg(target_os = "linux")]
|
|
mod linux_run_main;
|
|
#[cfg(target_os = "linux")]
|
|
mod vendored_bwrap;
|
|
|
|
#[cfg(target_os = "linux")]
|
|
pub fn run_main() -> ! {
|
|
linux_run_main::run_main();
|
|
}
|
|
|
|
#[cfg(not(target_os = "linux"))]
|
|
pub fn run_main() -> ! {
|
|
panic!("codex-linux-sandbox is only supported on Linux");
|
|
}
|