mirror of
https://github.com/openai/codex.git
synced 2026-05-04 13:21:54 +03:00
937cb5081d
Fixes #15283. ## Summary Older system bubblewrap builds reject `--argv0`, which makes our Linux sandbox fail before the helper can re-exec. This PR keeps using system `/usr/bin/bwrap` whenever it exists and only falls back to vendored bwrap when the system binary is missing. That matters on stricter AppArmor hosts, where the distro bwrap package also provides the policy setup needed for user namespaces. For old system bwrap, we avoid `--argv0` instead of switching binaries: - pass the sandbox helper a full-path `argv0`, - keep the existing `current_exe() + --argv0` path when the selected launcher supports it, - otherwise omit `--argv0` and re-exec through the helper's own `argv[0]` path, whose basename still dispatches as `codex-linux-sandbox`. Also updates the launcher/warning tests and docs so they match the new behavior: present-but-old system bwrap uses the compatibility path, and only absent system bwrap falls back to vendored. ### Validation 1. Install Ubuntu 20.04 in a VM 2. Compile codex and run without bubblewrap installed - see a warning about falling back to the vendored bwrap 3. Install bwrap and verify version is 0.4.0 without `argv0` support 4. run codex and use apply_patch tool without errors <img width="802" height="631" alt="Screenshot 2026-03-25 at 11 48 36 PM" src="https://github.com/user-attachments/assets/77248a29-aa38-4d7c-9833-496ec6a458b8" /> <img width="807" height="634" alt="Screenshot 2026-03-25 at 11 47 32 PM" src="https://github.com/user-attachments/assets/5af8b850-a466-489b-95a6-455b76b5050f" /> <img width="812" height="635" alt="Screenshot 2026-03-25 at 11 45 45 PM" src="https://github.com/user-attachments/assets/438074f0-8435-4274-a667-332efdd5cb57" /> <img width="801" height="623" alt="Screenshot 2026-03-25 at 11 43 56 PM" src="https://github.com/user-attachments/assets/0dc8d3f5-e8cf-4218-b4b4-a4f7d9bf02e3" /> --------- Co-authored-by: Michael Bolin <mbolin@openai.com>
102 lines
4.9 KiB
Markdown
102 lines
4.9 KiB
Markdown
# codex-core
|
|
|
|
This crate implements the business logic for Codex. It is designed to be used by the various Codex UIs written in Rust.
|
|
|
|
## Dependencies
|
|
|
|
Note that `codex-core` makes some assumptions about certain helper utilities being available in the environment. Currently, this support matrix is:
|
|
|
|
### macOS
|
|
|
|
Expects `/usr/bin/sandbox-exec` to be present.
|
|
|
|
When using the workspace-write sandbox policy, the Seatbelt profile allows
|
|
writes under the configured writable roots while keeping `.git` (directory or
|
|
pointer file), the resolved `gitdir:` target, and `.codex` read-only.
|
|
|
|
Network access and filesystem read/write roots are controlled by
|
|
`SandboxPolicy`. Seatbelt consumes the resolved policy and enforces it.
|
|
|
|
Seatbelt also supports macOS permission-profile extensions layered on top of
|
|
`SandboxPolicy`:
|
|
|
|
- no extension profile provided:
|
|
keeps legacy default preferences read access (`user-preference-read`).
|
|
- extension profile provided with no `macos_preferences` grant:
|
|
does not add preferences access clauses.
|
|
- `macos_preferences = "readonly"`:
|
|
enables cfprefs read clauses and `user-preference-read`.
|
|
- `macos_preferences = "readwrite"`:
|
|
includes readonly clauses plus `user-preference-write` and cfprefs shm write
|
|
clauses.
|
|
- `macos_automation = true`:
|
|
enables broad Apple Events send permissions.
|
|
- `macos_automation = ["com.apple.Notes", ...]`:
|
|
enables Apple Events send only to listed bundle IDs.
|
|
- `macos_launch_services = true`:
|
|
enables LaunchServices lookups and open/launch operations.
|
|
- `macos_accessibility = true`:
|
|
enables `com.apple.axserver` mach lookup.
|
|
- `macos_calendar = true`:
|
|
enables `com.apple.CalendarAgent` mach lookup.
|
|
- `macos_contacts = "read_only"`:
|
|
enables Address Book read access and Contacts read services.
|
|
- `macos_contacts = "read_write"`:
|
|
includes the readonly Contacts clauses plus Address Book writes and keychain/temp helpers required for writes.
|
|
|
|
### Linux
|
|
|
|
Expects the binary containing `codex-core` to run the equivalent of `codex sandbox linux` (legacy alias: `codex debug landlock`) when `arg0` is `codex-linux-sandbox`. See the `codex-arg0` crate for details.
|
|
|
|
Legacy `SandboxPolicy` / `sandbox_mode` configs are still supported on Linux.
|
|
They can continue to use the legacy Landlock path when the split filesystem
|
|
policy is sandbox-equivalent to the legacy model after `cwd` resolution.
|
|
Split filesystem policies that need direct `FileSystemSandboxPolicy`
|
|
enforcement, such as read-only or denied carveouts under a broader writable
|
|
root, automatically route through bubblewrap. The legacy Landlock path is used
|
|
only when the split filesystem policy round-trips through the legacy
|
|
`SandboxPolicy` model without changing semantics. That includes overlapping
|
|
cases like `/repo = write`, `/repo/a = none`, `/repo/a/b = write`, where the
|
|
more specific writable child must reopen under a denied parent.
|
|
|
|
The Linux sandbox helper prefers `/usr/bin/bwrap` whenever it is available. If
|
|
`/usr/bin/bwrap` is present but too old to support `--argv0`, the helper keeps
|
|
using system bubblewrap and switches to a no-`--argv0` compatibility path for
|
|
the inner re-exec. If `/usr/bin/bwrap` is missing, it falls back to the
|
|
vendored bubblewrap path compiled into the binary and Codex surfaces a startup
|
|
warning through its normal notification path instead of printing directly from
|
|
the sandbox helper.
|
|
|
|
### Windows
|
|
|
|
Legacy `SandboxPolicy` / `sandbox_mode` configs are still supported on
|
|
Windows.
|
|
|
|
The elevated setup/runner backend supports legacy `ReadOnlyAccess::Restricted`
|
|
for `read-only` and `workspace-write` policies. Restricted read access honors
|
|
explicit readable roots plus the command `cwd`, and keeps writable roots
|
|
readable when `workspace-write` is used.
|
|
|
|
When `include_platform_defaults = true`, the elevated Windows backend adds
|
|
backend-managed system read roots required for basic execution, such as
|
|
`C:\Windows`, `C:\Program Files`, `C:\Program Files (x86)`, and
|
|
`C:\ProgramData`. When it is `false`, those extra system roots are omitted.
|
|
|
|
The unelevated restricted-token backend still supports the legacy full-read
|
|
Windows model for legacy `ReadOnly` and `WorkspaceWrite` behavior. It also
|
|
supports a narrow split-filesystem subset: full-read split policies whose
|
|
writable roots still match the legacy `WorkspaceWrite` root set, but add extra
|
|
read-only carveouts under those writable roots.
|
|
|
|
New `[permissions]` / split filesystem policies remain supported on Windows
|
|
only when they round-trip through the legacy `SandboxPolicy` model without
|
|
changing semantics. Policies that would require direct read restriction,
|
|
explicit unreadable carveouts, reopened writable descendants under read-only
|
|
carveouts, different writable root sets, or split carveout support in the
|
|
elevated setup/runner backend still fail closed instead of running with weaker
|
|
enforcement.
|
|
|
|
### All Platforms
|
|
|
|
Expects the binary containing `codex-core` to simulate the virtual `apply_patch` CLI when `arg1` is `--codex-run-as-apply-patch`. See the `codex-arg0` crate for details.
|