mirror of
https://github.com/openai/codex.git
synced 2026-10-26 07:58:43 +00:00
jif
f6950546e5
## Why A sandboxed process could replace a writable directory root, changing the authority boundary used to construct a later sandbox policy. ## What changed - Deny unlinking or renaming directory roots granted write access by Seatbelt, while preserving replacement and deletion behavior for writable files. - Reject writable roots with nested symlink components and report these as Seatbelt preparation errors instead of network proxy failures. - Normalize writable roots before adding them to the generated Seatbelt policy. ## Testing Add coverage for symlink rejection, error classification, directory-root replacement and rename protection, newly created roots, and writable file replacement. GitOrigin-RevId: ab1ed4e55f20034bc43e028e6529d3d1f0d8181c
90 lines
3.4 KiB
Rust
90 lines
3.4 KiB
Rust
#[cfg(target_os = "linux")]
|
|
mod bwrap;
|
|
mod denial;
|
|
pub mod landlock;
|
|
mod manager;
|
|
pub mod policy_transforms;
|
|
#[cfg(target_os = "macos")]
|
|
pub mod seatbelt;
|
|
mod spawn;
|
|
mod violation;
|
|
mod windows;
|
|
|
|
#[cfg(target_os = "linux")]
|
|
pub use bwrap::find_system_bwrap_in_path;
|
|
#[cfg(target_os = "linux")]
|
|
pub use bwrap::system_bwrap_warning;
|
|
pub use codex_windows_sandbox::WindowsSandboxProxySettingsMode;
|
|
pub use denial::is_likely_executor_managed_sandbox_denied;
|
|
pub use denial::is_likely_sandbox_denied;
|
|
pub use manager::SandboxCommand;
|
|
pub use manager::SandboxDirectSpawnTransformRequest;
|
|
pub use manager::SandboxExecRequest;
|
|
pub use manager::SandboxManager;
|
|
pub use manager::SandboxTransformError;
|
|
pub use manager::SandboxTransformRequest;
|
|
pub use manager::SandboxType;
|
|
pub use manager::SandboxablePreference;
|
|
pub use manager::compatibility_sandbox_policy_for_permission_profile;
|
|
pub use manager::get_platform_sandbox;
|
|
pub use manager::with_managed_mitm_ca_readable_root;
|
|
pub use spawn::SpawnRequest;
|
|
pub use spawn::WindowsSandboxSpawnRequest;
|
|
pub use spawn::spawn_process;
|
|
pub use violation::FileSystemSandboxViolation;
|
|
pub use violation::FileSystemSandboxViolationReason;
|
|
pub use violation::NetworkSandboxViolation;
|
|
pub use violation::SandboxViolationBackend;
|
|
pub use violation::SandboxViolationEvent;
|
|
pub use violation::record_filesystem_sandbox_violation;
|
|
pub use violation::record_network_sandbox_violation;
|
|
pub use violation::record_sandbox_violation;
|
|
pub use windows::WindowsSandboxFilesystemOverrides;
|
|
pub use windows::permission_profile_supports_windows_restricted_token_sandbox;
|
|
pub use windows::resolve_windows_elevated_filesystem_overrides;
|
|
pub use windows::resolve_windows_restricted_token_filesystem_overrides;
|
|
pub use windows::unsupported_windows_restricted_token_sandbox_reason;
|
|
pub use windows::windows_sandbox_uses_elevated_backend;
|
|
|
|
use codex_protocol::error::CodexErr;
|
|
|
|
#[cfg(not(target_os = "linux"))]
|
|
pub fn system_bwrap_warning(
|
|
_permission_profile: &codex_protocol::models::PermissionProfile,
|
|
) -> Option<String> {
|
|
None
|
|
}
|
|
|
|
impl From<SandboxTransformError> for CodexErr {
|
|
fn from(err: SandboxTransformError) -> Self {
|
|
match err {
|
|
error @ SandboxTransformError::InvalidCommandCwd { .. }
|
|
| error @ SandboxTransformError::InvalidSandboxPolicyCwd { .. } => {
|
|
CodexErr::InvalidRequest(error.to_string())
|
|
}
|
|
SandboxTransformError::MissingLinuxSandboxExecutable => {
|
|
CodexErr::LandlockSandboxExecutableNotProvided
|
|
}
|
|
SandboxTransformError::EnvironmentNetworkProxy(message) => {
|
|
CodexErr::UnsupportedOperation(message)
|
|
}
|
|
#[cfg(target_os = "macos")]
|
|
SandboxTransformError::SeatbeltPreparation(message) => {
|
|
CodexErr::UnsupportedOperation(message)
|
|
}
|
|
#[cfg(target_os = "linux")]
|
|
SandboxTransformError::Wsl1UnsupportedForBubblewrap => {
|
|
CodexErr::UnsupportedOperation(crate::bwrap::WSL1_BWRAP_WARNING.to_string())
|
|
}
|
|
#[cfg(not(target_os = "macos"))]
|
|
SandboxTransformError::SeatbeltUnavailable => CodexErr::UnsupportedOperation(
|
|
"seatbelt sandbox is only available on macOS".to_string(),
|
|
),
|
|
#[cfg(target_os = "windows")]
|
|
SandboxTransformError::WindowsSandboxPreparation(message) => {
|
|
CodexErr::UnsupportedOperation(message)
|
|
}
|
|
}
|
|
}
|
|
}
|