mirror of https://github.com/openai/codex.git synced 2026-05-01 18:06:47 +00:00

Files

Michael Bolin d1088158b8 fix: fall back to vendored bubblewrap when system bwrap lacks --argv0 (#15338 )

## Why

Fixes [#15283](https://github.com/openai/codex/issues/15283), where
sandboxed tool calls fail on older distro `bubblewrap` builds because
`/usr/bin/bwrap` does not understand `--argv0`. The upstream [bubblewrap
v0.9.0 release
notes](https://github.com/containers/bubblewrap/releases/tag/v0.9.0)
explicitly call out `Add --argv0`. Flipping `use_legacy_landlock`
globally works around that compatibility bug, but it also weakens the
default Linux sandbox and breaks proxy-routed and split-policy cases
called out in review.

The follow-up Linux CI failure was in the new launcher test rather than
the launcher logic: the fake `bwrap` helper stayed open for writing, so
Linux would not exec it. This update also closes the user-visibility gap
from review by surfacing the same startup warning when `/usr/bin/bwrap`
is present but too old for `--argv0`, not only when it is missing.

## What Changed

- keep `use_legacy_landlock` default-disabled
- teach `codex-rs/linux-sandbox/src/launcher.rs` to fall back to the
vendored bubblewrap build when `/usr/bin/bwrap` does not advertise
`--argv0` support
- add launcher tests for supported, unsupported, and missing system
`bwrap`
- write the fake `bwrap` test helper to a closed temp path so the
supported-path launcher test works on Linux too
- extend the startup warning path so Codex warns when `/usr/bin/bwrap`
is missing or too old to support `--argv0`
- mirror the warning/fallback wording across
`codex-rs/linux-sandbox/README.md` and `codex-rs/core/README.md`,
including that the fallback is the vendored bubblewrap compiled into the
binary
- cite the upstream `bubblewrap` release that introduced `--argv0`

## Verification

- `bazel test --config=remote --platforms=//:rbe
//codex-rs/linux-sandbox:linux-sandbox-unit-tests
--test_filter=launcher::tests::prefers_system_bwrap_when_help_lists_argv0
--test_output=errors`
- `cargo test -p codex-core system_bwrap_warning`
- `cargo check -p codex-exec -p codex-tui -p codex-tui-app-server -p
codex-app-server`
- `just argument-comment-lint`

2026-03-23 09:46:51 -07:00

4.5 KiB

Raw Blame History

codex-core

This crate implements the business logic for Codex. It is designed to be used by the various Codex UIs written in Rust.

Dependencies

Note that codex-core makes some assumptions about certain helper utilities being available in the environment. Currently, this support matrix is:

macOS

Expects /usr/bin/sandbox-exec to be present.

When using the workspace-write sandbox policy, the Seatbelt profile allows writes under the configured writable roots while keeping .git (directory or pointer file), the resolved gitdir: target, and .codex read-only.

Network access and filesystem read/write roots are controlled by SandboxPolicy. Seatbelt consumes the resolved policy and enforces it.

Seatbelt also supports macOS permission-profile extensions layered on top of SandboxPolicy:

no extension profile provided: keeps legacy default preferences read access (user-preference-read).
extension profile provided with no macos_preferences grant: does not add preferences access clauses.
macos_preferences = "readonly": enables cfprefs read clauses and user-preference-read.
macos_preferences = "readwrite": includes readonly clauses plus user-preference-write and cfprefs shm write clauses.
macos_automation = true: enables broad Apple Events send permissions.
macos_automation = ["com.apple.Notes", ...]: enables Apple Events send only to listed bundle IDs.
macos_launch_services = true: enables LaunchServices lookups and open/launch operations.
macos_accessibility = true: enables com.apple.axserver mach lookup.
macos_calendar = true: enables com.apple.CalendarAgent mach lookup.
macos_contacts = "read_only": enables Address Book read access and Contacts read services.
macos_contacts = "read_write": includes the readonly Contacts clauses plus Address Book writes and keychain/temp helpers required for writes.

Linux

Expects the binary containing codex-core to run the equivalent of codex sandbox linux (legacy alias: codex debug landlock) when arg0 is codex-linux-sandbox. See the codex-arg0 crate for details.

Legacy SandboxPolicy / sandbox_mode configs are still supported on Linux. They can continue to use the legacy Landlock path when the split filesystem policy is sandbox-equivalent to the legacy model after cwd resolution.

Split filesystem policies that need direct FileSystemSandboxPolicy enforcement, such as read-only or denied carveouts under a broader writable root, automatically route through bubblewrap. The legacy Landlock path is used only when the split filesystem policy round-trips through the legacy SandboxPolicy model without changing semantics. That includes overlapping cases like /repo = write, /repo/a = none, /repo/a/b = write, where the more specific writable child must reopen under a denied parent.

The Linux sandbox helper prefers /usr/bin/bwrap whenever it is available and supports the required argv-rewrite flags, and falls back to the vendored bubblewrap path compiled into the binary otherwise. When /usr/bin/bwrap is missing or too old to support the required flags, Codex also surfaces a startup warning through its normal notification path instead of printing directly from the sandbox helper.

Windows

Legacy SandboxPolicy / sandbox_mode configs are still supported on Windows.

The elevated setup/runner backend supports legacy ReadOnlyAccess::Restricted for read-only and workspace-write policies. Restricted read access honors explicit readable roots plus the command cwd, and keeps writable roots readable when workspace-write is used.

When include_platform_defaults = true, the elevated Windows backend adds backend-managed system read roots required for basic execution, such as C:\Windows, C:\Program Files, C:\Program Files (x86), and C:\ProgramData. When it is false, those extra system roots are omitted.

The unelevated restricted-token backend still supports the legacy full-read Windows model only. Restricted read-only policies continue to fail closed there instead of running with weaker read enforcement.

New [permissions] / split filesystem policies remain supported on Windows only when they round-trip through the legacy SandboxPolicy model without changing semantics. Richer split-only carveouts still fail closed instead of running with weaker enforcement.

All Platforms

Expects the binary containing codex-core to simulate the virtual apply_patch CLI when arg1 is --codex-run-as-apply-patch. See the codex-arg0 crate for details.

4.5 KiB Raw Blame History