Extract landlock helpers into codex-sandboxing (#15592)

## Summary
- add a new `codex-sandboxing` crate for sandboxing extraction work
- move the pure Linux sandbox argv builders and their unit tests out of
`codex-core`
- keep `core::landlock` as the spawn wrapper and update direct callers
to use `codex_sandboxing::landlock`

## Testing
- `cargo test -p codex-sandboxing`
- `cargo test -p codex-core landlock`
- `cargo test -p codex-cli debug_sandbox`
- `just argument-comment-lint`

## Notes
- this is step 1 of the move plan aimed at minimizing per-PR diffs
- no re-exports or no-op proxy methods were added

codex-rs/sandboxing/src/landlock.rs

@@ -0,0 +1,112 @@
+use codex_protocol::permissions::FileSystemSandboxPolicy;
+use codex_protocol::permissions::NetworkSandboxPolicy;
+use codex_protocol::protocol::SandboxPolicy;
+use std::path::Path;
+pub fn allow_network_for_proxy(enforce_managed_network: bool) -> bool {
+    // When managed network requirements are active, request proxy-only
+    // networking from the Linux sandbox helper. Without managed requirements,
+    // preserve existing behavior.
+    enforce_managed_network
+}
+
+/// Converts the sandbox policies into the CLI invocation for
+/// `codex-linux-sandbox`.
+///
+/// The helper performs the actual sandboxing (bubblewrap by default + seccomp) after
+/// parsing these arguments. Policy JSON flags are emitted before helper feature
+/// flags so the argv order matches the helper's CLI shape. See
+/// `docs/linux_sandbox.md` for the Linux semantics.
+#[allow(clippy::too_many_arguments)]
+pub fn create_linux_sandbox_command_args_for_policies(
+    command: Vec<String>,
+    command_cwd: &Path,
+    sandbox_policy: &SandboxPolicy,
+    file_system_sandbox_policy: &FileSystemSandboxPolicy,
+    network_sandbox_policy: NetworkSandboxPolicy,
+    sandbox_policy_cwd: &Path,
+    use_legacy_landlock: bool,
+    allow_network_for_proxy: bool,
+) -> Vec<String> {
+    let sandbox_policy_json = serde_json::to_string(sandbox_policy)
+        .unwrap_or_else(|err| panic!("failed to serialize sandbox policy: {err}"));
+    let file_system_policy_json = serde_json::to_string(file_system_sandbox_policy)
+        .unwrap_or_else(|err| panic!("failed to serialize filesystem sandbox policy: {err}"));
+    let network_policy_json = serde_json::to_string(&network_sandbox_policy)
+        .unwrap_or_else(|err| panic!("failed to serialize network sandbox policy: {err}"));
+    let sandbox_policy_cwd = sandbox_policy_cwd
+        .to_str()
+        .unwrap_or_else(|| panic!("cwd must be valid UTF-8"))
+        .to_string();
+    let command_cwd = command_cwd
+        .to_str()
+        .unwrap_or_else(|| panic!("command cwd must be valid UTF-8"))
+        .to_string();
+
+    let mut linux_cmd: Vec<String> = vec![
+        "--sandbox-policy-cwd".to_string(),
+        sandbox_policy_cwd,
+        "--command-cwd".to_string(),
+        command_cwd,
+        "--sandbox-policy".to_string(),
+        sandbox_policy_json,
+        "--file-system-sandbox-policy".to_string(),
+        file_system_policy_json,
+        "--network-sandbox-policy".to_string(),
+        network_policy_json,
+    ];
+    if use_legacy_landlock {
+        linux_cmd.push("--use-legacy-landlock".to_string());
+    }
+    if allow_network_for_proxy {
+        linux_cmd.push("--allow-network-for-proxy".to_string());
+    }
+    linux_cmd.push("--".to_string());
+    linux_cmd.extend(command);
+    linux_cmd
+}
+
+/// Converts the sandbox cwd and execution options into the CLI invocation for
+/// `codex-linux-sandbox`.
+#[cfg_attr(not(test), allow(dead_code))]
+fn create_linux_sandbox_command_args(
+    command: Vec<String>,
+    command_cwd: &Path,
+    sandbox_policy_cwd: &Path,
+    use_legacy_landlock: bool,
+    allow_network_for_proxy: bool,
+) -> Vec<String> {
+    let command_cwd = command_cwd
+        .to_str()
+        .unwrap_or_else(|| panic!("command cwd must be valid UTF-8"))
+        .to_string();
+    let sandbox_policy_cwd = sandbox_policy_cwd
+        .to_str()
+        .unwrap_or_else(|| panic!("cwd must be valid UTF-8"))
+        .to_string();
+
+    let mut linux_cmd: Vec<String> = vec![
+        "--sandbox-policy-cwd".to_string(),
+        sandbox_policy_cwd,
+        "--command-cwd".to_string(),
+        command_cwd,
+    ];
+    if use_legacy_landlock {
+        linux_cmd.push("--use-legacy-landlock".to_string());
+    }
+    if allow_network_for_proxy {
+        linux_cmd.push("--allow-network-for-proxy".to_string());
+    }
+
+    // Separator so that command arguments starting with `-` are not parsed as
+    // options of the helper itself.
+    linux_cmd.push("--".to_string());
+
+    // Append the original tool command.
+    linux_cmd.extend(command);
+
+    linux_cmd
+}
+
+#[cfg(test)]
+#[path = "landlock_tests.rs"]
+mod tests;

codex-rs/sandboxing/src/landlock_tests.rs

@@ -0,0 +1,78 @@
+use super::*;
+use pretty_assertions::assert_eq;
+
+#[test]
+fn legacy_landlock_flag_is_included_when_requested() {
+    let command = vec!["/bin/true".to_string()];
+    let command_cwd = Path::new("/tmp/link");
+    let cwd = Path::new("/tmp");
+
+    let default_bwrap =
+        create_linux_sandbox_command_args(command.clone(), command_cwd, cwd, false, false);
+    assert_eq!(
+        default_bwrap.contains(&"--use-legacy-landlock".to_string()),
+        false
+    );
+
+    let legacy_landlock = create_linux_sandbox_command_args(command, command_cwd, cwd, true, false);
+    assert_eq!(
+        legacy_landlock.contains(&"--use-legacy-landlock".to_string()),
+        true
+    );
+}
+
+#[test]
+fn proxy_flag_is_included_when_requested() {
+    let command = vec!["/bin/true".to_string()];
+    let command_cwd = Path::new("/tmp/link");
+    let cwd = Path::new("/tmp");
+
+    let args = create_linux_sandbox_command_args(command, command_cwd, cwd, true, true);
+    assert_eq!(
+        args.contains(&"--allow-network-for-proxy".to_string()),
+        true
+    );
+}
+
+#[test]
+fn split_policy_flags_are_included() {
+    let command = vec!["/bin/true".to_string()];
+    let command_cwd = Path::new("/tmp/link");
+    let cwd = Path::new("/tmp");
+    let sandbox_policy = SandboxPolicy::new_read_only_policy();
+    let file_system_sandbox_policy = FileSystemSandboxPolicy::from(&sandbox_policy);
+    let network_sandbox_policy = NetworkSandboxPolicy::from(&sandbox_policy);
+
+    let args = create_linux_sandbox_command_args_for_policies(
+        command,
+        command_cwd,
+        &sandbox_policy,
+        &file_system_sandbox_policy,
+        network_sandbox_policy,
+        cwd,
+        true,
+        false,
+    );
+
+    assert_eq!(
+        args.windows(2)
+            .any(|window| { window[0] == "--file-system-sandbox-policy" && !window[1].is_empty() }),
+        true
+    );
+    assert_eq!(
+        args.windows(2)
+            .any(|window| window[0] == "--network-sandbox-policy" && window[1] == "\"restricted\""),
+        true
+    );
+    assert_eq!(
+        args.windows(2)
+            .any(|window| window[0] == "--command-cwd" && window[1] == "/tmp/link"),
+        true
+    );
+}
+
+#[test]
+fn proxy_network_requires_managed_requirements() {
+    assert_eq!(allow_network_for_proxy(false), false);
+    assert_eq!(allow_network_for_proxy(true), true);
+}

codex-rs/sandboxing/src/lib.rs

@@ -0,0 +1 @@
+pub mod landlock;