mirror of
https://github.com/openai/codex.git
synced 2026-04-29 00:55:38 +00:00
dcc4d7b634
## Why After `#13449`, the Linux helper could receive split filesystem and network policies, but the bubblewrap mount builder still reconstructed filesystem access from the legacy `SandboxPolicy`. That loses explicit unreadable carveouts under writable roots, and it also mishandles `Root` read access paired with explicit deny carveouts. In those cases bubblewrap could still expose paths that the split filesystem policy intentionally blocked. ## What changed - switched bubblewrap mount generation to consume `FileSystemSandboxPolicy` directly at the implementation boundary; legacy `SandboxPolicy` configs still flow through the existing `FileSystemSandboxPolicy::from(&sandbox_policy)` bridge before reaching bwrap - kept the Linux helper and preflight path on the split filesystem policy all the way into bwrap - re-applied explicit unreadable carveouts after readable and writable mounts so blocked subpaths still win under bubblewrap - masked denied directories with `--tmpfs` plus `--remount-ro` and denied files with `--ro-bind-data`, preserving the backing fd until exec - added comments in the unreadable-root masking block to explain why the mount order and directory/file split are intentional - updated Linux helper call sites and tests for the split-policy bwrap path ## Verification - added protocol coverage for root carveouts staying scoped - added core coverage that root-write plus deny carveouts still requires a platform sandbox - added bwrap unit coverage for reapplying blocked carveouts after writable binds - added Linux integration coverage for explicit split-policy carveouts under bubblewrap - validated the final branch state with `cargo test -p codex-linux-sandbox`, `cargo clippy -p codex-linux-sandbox --all-targets -- -D warnings`, and the PR CI reruns --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/openai/codex/pull/13453). * __->__ #13453 * #13452 * #13451 * #13449 * #13448 * #13445 * #13440 * #13439 --------- Co-authored-by: viyatb-oai <viyatb@openai.com>
80 lines
2.8 KiB
Rust
80 lines
2.8 KiB
Rust
//! Build-time bubblewrap entrypoint.
|
|
//!
|
|
//! On Linux targets, the build script compiles bubblewrap's C sources and
|
|
//! exposes a `bwrap_main` symbol that we can call via FFI.
|
|
|
|
#[cfg(vendored_bwrap_available)]
|
|
mod imp {
|
|
use std::ffi::CString;
|
|
use std::fs::File;
|
|
use std::os::raw::c_char;
|
|
|
|
unsafe extern "C" {
|
|
fn bwrap_main(argc: libc::c_int, argv: *const *const c_char) -> libc::c_int;
|
|
}
|
|
|
|
fn argv_to_cstrings(argv: &[String]) -> Vec<CString> {
|
|
let mut cstrings: Vec<CString> = Vec::with_capacity(argv.len());
|
|
for arg in argv {
|
|
match CString::new(arg.as_str()) {
|
|
Ok(value) => cstrings.push(value),
|
|
Err(err) => panic!("failed to convert argv to CString: {err}"),
|
|
}
|
|
}
|
|
cstrings
|
|
}
|
|
|
|
/// Run the build-time bubblewrap `main` function and return its exit code.
|
|
///
|
|
/// On success, bubblewrap will `execve` into the target program and this
|
|
/// function will never return. A return value therefore implies failure.
|
|
pub(crate) fn run_vendored_bwrap_main(
|
|
argv: &[String],
|
|
_preserved_files: &[File],
|
|
) -> libc::c_int {
|
|
let cstrings = argv_to_cstrings(argv);
|
|
|
|
let mut argv_ptrs: Vec<*const c_char> = cstrings.iter().map(|arg| arg.as_ptr()).collect();
|
|
argv_ptrs.push(std::ptr::null());
|
|
|
|
// SAFETY: We provide a null-terminated argv vector whose pointers
|
|
// remain valid for the duration of the call.
|
|
unsafe { bwrap_main(cstrings.len() as libc::c_int, argv_ptrs.as_ptr()) }
|
|
}
|
|
|
|
/// Execute the build-time bubblewrap `main` function with the given argv.
|
|
pub(crate) fn exec_vendored_bwrap(argv: Vec<String>, preserved_files: Vec<File>) -> ! {
|
|
let exit_code = run_vendored_bwrap_main(&argv, &preserved_files);
|
|
std::process::exit(exit_code);
|
|
}
|
|
}
|
|
|
|
#[cfg(not(vendored_bwrap_available))]
|
|
mod imp {
|
|
use std::fs::File;
|
|
|
|
/// Panics with a clear error when the build-time bwrap path is not enabled.
|
|
pub(crate) fn run_vendored_bwrap_main(
|
|
_argv: &[String],
|
|
_preserved_files: &[File],
|
|
) -> libc::c_int {
|
|
panic!(
|
|
r#"build-time bubblewrap is not available in this build.
|
|
codex-linux-sandbox should always compile vendored bubblewrap on Linux targets.
|
|
Notes:
|
|
- ensure the target OS is Linux
|
|
- libcap headers must be available via pkg-config
|
|
- bubblewrap sources expected at codex-rs/vendor/bubblewrap (default)"#
|
|
);
|
|
}
|
|
|
|
/// Panics with a clear error when the build-time bwrap path is not enabled.
|
|
pub(crate) fn exec_vendored_bwrap(_argv: Vec<String>, _preserved_files: Vec<File>) -> ! {
|
|
let _ = run_vendored_bwrap_main(&[], &[]);
|
|
unreachable!("run_vendored_bwrap_main should always panic in this configuration")
|
|
}
|
|
}
|
|
|
|
pub(crate) use imp::exec_vendored_bwrap;
|
|
pub(crate) use imp::run_vendored_bwrap_main;
|