mirror of
https://github.com/openai/codex.git
synced 2026-04-25 07:05:38 +00:00
3d2f123895
## Why #18274 made `PermissionProfile` the canonical file-system permissions shape, but the round-trip from `FileSystemSandboxPolicy` to `PermissionProfile` still dropped one piece of policy metadata: `glob_scan_max_depth`. That field is security-relevant for deny-read globs such as `**/*.env`. On Linux, bubblewrap sandbox construction uses it to bound unreadable glob expansion. If a profile copied from active runtime permissions loses this value and is submitted back as an override, the resulting `FileSystemSandboxPolicy` can behave differently even though the visible permission entries look equivalent. ## What changed - Add `glob_scan_max_depth` to protocol `FileSystemPermissions` and preserve it when converting to/from `FileSystemSandboxPolicy`. - Keep legacy `read`/`write` JSON for simple path-only permissions, but force canonical JSON when glob scan depth is present so the metadata is not silently dropped. - Carry `globScanMaxDepth` through app-server `AdditionalFileSystemPermissions`, generated JSON/TypeScript schemas, and app-server/TUI conversion call sites. - Preserve the metadata through sandboxing permission normalization, merging, and intersection. - Carry the merged scan depth into the effective `FileSystemSandboxPolicy` used for command execution, so bounded deny-read globs reach Linux bubblewrap materialization. ## Verification - `cargo test -p codex-sandboxing glob_scan -- --nocapture` - `cargo test -p codex-sandboxing policy_transforms -- --nocapture` - `just fix -p codex-sandboxing` --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/openai/codex/pull/18713). * #18288 * #18287 * #18286 * #18285 * #18284 * #18283 * #18282 * #18281 * #18280 * #18279 * #18278 * #18277 * #18276 * #18275 * __->__ #18713
622 lines
14 KiB
JSON
Generated
622 lines
14 KiB
JSON
Generated
{
|
|
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
"definitions": {
|
|
"AbsolutePathBuf": {
|
|
"description": "A path that is guaranteed to be absolute and normalized (though it is not guaranteed to be canonicalized or exist on the filesystem).\n\nIMPORTANT: When deserializing an `AbsolutePathBuf`, a base path must be set using [AbsolutePathBufGuard::new]. If no base path is set, the deserialization will fail unless the path being deserialized is already absolute.",
|
|
"type": "string"
|
|
},
|
|
"AdditionalFileSystemPermissions": {
|
|
"properties": {
|
|
"entries": {
|
|
"items": {
|
|
"$ref": "#/definitions/FileSystemSandboxEntry"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
},
|
|
"globScanMaxDepth": {
|
|
"format": "uint",
|
|
"minimum": 1.0,
|
|
"type": [
|
|
"integer",
|
|
"null"
|
|
]
|
|
},
|
|
"read": {
|
|
"items": {
|
|
"$ref": "#/definitions/AbsolutePathBuf"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
},
|
|
"write": {
|
|
"items": {
|
|
"$ref": "#/definitions/AbsolutePathBuf"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"AdditionalNetworkPermissions": {
|
|
"properties": {
|
|
"enabled": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"AdditionalPermissionProfile": {
|
|
"properties": {
|
|
"fileSystem": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/AdditionalFileSystemPermissions"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"network": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/AdditionalNetworkPermissions"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"CommandAction": {
|
|
"oneOf": [
|
|
{
|
|
"properties": {
|
|
"command": {
|
|
"type": "string"
|
|
},
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"path": {
|
|
"$ref": "#/definitions/AbsolutePathBuf"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"read"
|
|
],
|
|
"title": "ReadCommandActionType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"command",
|
|
"name",
|
|
"path",
|
|
"type"
|
|
],
|
|
"title": "ReadCommandAction",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"command": {
|
|
"type": "string"
|
|
},
|
|
"path": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"listFiles"
|
|
],
|
|
"title": "ListFilesCommandActionType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"command",
|
|
"type"
|
|
],
|
|
"title": "ListFilesCommandAction",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"command": {
|
|
"type": "string"
|
|
},
|
|
"path": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"query": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"search"
|
|
],
|
|
"title": "SearchCommandActionType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"command",
|
|
"type"
|
|
],
|
|
"title": "SearchCommandAction",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"command": {
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"unknown"
|
|
],
|
|
"title": "UnknownCommandActionType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"command",
|
|
"type"
|
|
],
|
|
"title": "UnknownCommandAction",
|
|
"type": "object"
|
|
}
|
|
]
|
|
},
|
|
"CommandExecutionApprovalDecision": {
|
|
"oneOf": [
|
|
{
|
|
"description": "User approved the command.",
|
|
"enum": [
|
|
"accept"
|
|
],
|
|
"type": "string"
|
|
},
|
|
{
|
|
"description": "User approved the command and future prompts in the same session-scoped approval cache should run without prompting.",
|
|
"enum": [
|
|
"acceptForSession"
|
|
],
|
|
"type": "string"
|
|
},
|
|
{
|
|
"additionalProperties": false,
|
|
"description": "User approved the command, and wants to apply the proposed execpolicy amendment so future matching commands can run without prompting.",
|
|
"properties": {
|
|
"acceptWithExecpolicyAmendment": {
|
|
"properties": {
|
|
"execpolicy_amendment": {
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
}
|
|
},
|
|
"required": [
|
|
"execpolicy_amendment"
|
|
],
|
|
"type": "object"
|
|
}
|
|
},
|
|
"required": [
|
|
"acceptWithExecpolicyAmendment"
|
|
],
|
|
"title": "AcceptWithExecpolicyAmendmentCommandExecutionApprovalDecision",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"additionalProperties": false,
|
|
"description": "User chose a persistent network policy rule (allow/deny) for this host.",
|
|
"properties": {
|
|
"applyNetworkPolicyAmendment": {
|
|
"properties": {
|
|
"network_policy_amendment": {
|
|
"$ref": "#/definitions/NetworkPolicyAmendment"
|
|
}
|
|
},
|
|
"required": [
|
|
"network_policy_amendment"
|
|
],
|
|
"type": "object"
|
|
}
|
|
},
|
|
"required": [
|
|
"applyNetworkPolicyAmendment"
|
|
],
|
|
"title": "ApplyNetworkPolicyAmendmentCommandExecutionApprovalDecision",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"description": "User denied the command. The agent will continue the turn.",
|
|
"enum": [
|
|
"decline"
|
|
],
|
|
"type": "string"
|
|
},
|
|
{
|
|
"description": "User denied the command. The turn will also be immediately interrupted.",
|
|
"enum": [
|
|
"cancel"
|
|
],
|
|
"type": "string"
|
|
}
|
|
]
|
|
},
|
|
"FileSystemAccessMode": {
|
|
"enum": [
|
|
"read",
|
|
"write",
|
|
"none"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"FileSystemPath": {
|
|
"oneOf": [
|
|
{
|
|
"properties": {
|
|
"path": {
|
|
"$ref": "#/definitions/AbsolutePathBuf"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"path"
|
|
],
|
|
"title": "PathFileSystemPathType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"path",
|
|
"type"
|
|
],
|
|
"title": "PathFileSystemPath",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"pattern": {
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"glob_pattern"
|
|
],
|
|
"title": "GlobPatternFileSystemPathType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"pattern",
|
|
"type"
|
|
],
|
|
"title": "GlobPatternFileSystemPath",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"type": {
|
|
"enum": [
|
|
"special"
|
|
],
|
|
"title": "SpecialFileSystemPathType",
|
|
"type": "string"
|
|
},
|
|
"value": {
|
|
"$ref": "#/definitions/FileSystemSpecialPath"
|
|
}
|
|
},
|
|
"required": [
|
|
"type",
|
|
"value"
|
|
],
|
|
"title": "SpecialFileSystemPath",
|
|
"type": "object"
|
|
}
|
|
]
|
|
},
|
|
"FileSystemSandboxEntry": {
|
|
"properties": {
|
|
"access": {
|
|
"$ref": "#/definitions/FileSystemAccessMode"
|
|
},
|
|
"path": {
|
|
"$ref": "#/definitions/FileSystemPath"
|
|
}
|
|
},
|
|
"required": [
|
|
"access",
|
|
"path"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"FileSystemSpecialPath": {
|
|
"oneOf": [
|
|
{
|
|
"properties": {
|
|
"kind": {
|
|
"enum": [
|
|
"root"
|
|
],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"kind"
|
|
],
|
|
"title": "RootFileSystemSpecialPath",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"kind": {
|
|
"enum": [
|
|
"minimal"
|
|
],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"kind"
|
|
],
|
|
"title": "MinimalFileSystemSpecialPath",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"kind": {
|
|
"enum": [
|
|
"current_working_directory"
|
|
],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"kind"
|
|
],
|
|
"title": "CurrentWorkingDirectoryFileSystemSpecialPath",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"kind": {
|
|
"enum": [
|
|
"project_roots"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"subpath": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"kind"
|
|
],
|
|
"title": "KindFileSystemSpecialPath",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"kind": {
|
|
"enum": [
|
|
"tmpdir"
|
|
],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"kind"
|
|
],
|
|
"title": "TmpdirFileSystemSpecialPath",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"kind": {
|
|
"enum": [
|
|
"slash_tmp"
|
|
],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"kind"
|
|
],
|
|
"title": "SlashTmpFileSystemSpecialPath",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"kind": {
|
|
"enum": [
|
|
"unknown"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"path": {
|
|
"type": "string"
|
|
},
|
|
"subpath": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"kind",
|
|
"path"
|
|
],
|
|
"type": "object"
|
|
}
|
|
]
|
|
},
|
|
"NetworkApprovalContext": {
|
|
"properties": {
|
|
"host": {
|
|
"type": "string"
|
|
},
|
|
"protocol": {
|
|
"$ref": "#/definitions/NetworkApprovalProtocol"
|
|
}
|
|
},
|
|
"required": [
|
|
"host",
|
|
"protocol"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"NetworkApprovalProtocol": {
|
|
"enum": [
|
|
"http",
|
|
"https",
|
|
"socks5Tcp",
|
|
"socks5Udp"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"NetworkPolicyAmendment": {
|
|
"properties": {
|
|
"action": {
|
|
"$ref": "#/definitions/NetworkPolicyRuleAction"
|
|
},
|
|
"host": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"action",
|
|
"host"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"NetworkPolicyRuleAction": {
|
|
"enum": [
|
|
"allow",
|
|
"deny"
|
|
],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"properties": {
|
|
"approvalId": {
|
|
"description": "Unique identifier for this specific approval callback.\n\nFor regular shell/unified_exec approvals, this is null.\n\nFor zsh-exec-bridge subcommand approvals, multiple callbacks can belong to one parent `itemId`, so `approvalId` is a distinct opaque callback id (a UUID) used to disambiguate routing.",
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"command": {
|
|
"description": "The command to be executed.",
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"commandActions": {
|
|
"description": "Best-effort parsed command actions for friendly display.",
|
|
"items": {
|
|
"$ref": "#/definitions/CommandAction"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
},
|
|
"cwd": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/AbsolutePathBuf"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "The command's working directory."
|
|
},
|
|
"itemId": {
|
|
"type": "string"
|
|
},
|
|
"networkApprovalContext": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/NetworkApprovalContext"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Optional context for a managed-network approval prompt."
|
|
},
|
|
"proposedExecpolicyAmendment": {
|
|
"description": "Optional proposed execpolicy amendment to allow similar commands without prompting.",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
},
|
|
"proposedNetworkPolicyAmendments": {
|
|
"description": "Optional proposed network policy amendments (allow/deny host) for future requests.",
|
|
"items": {
|
|
"$ref": "#/definitions/NetworkPolicyAmendment"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
},
|
|
"reason": {
|
|
"description": "Optional explanatory reason (e.g. request for network access).",
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"threadId": {
|
|
"type": "string"
|
|
},
|
|
"turnId": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"itemId",
|
|
"threadId",
|
|
"turnId"
|
|
],
|
|
"title": "CommandExecutionRequestApprovalParams",
|
|
"type": "object"
|
|
} |