codex

github/codex

0 Fork 0

mirror of https://github.com/openai/codex.git synced 2026-11-13 06:45:07 +00:00

Files

T

Adam Perry @ OpenAI 6cc2ba8a95 Support FD mounts with older system Bubblewrap versions (#39404 )

## Why

System Bubblewrap installations that lack `--ro-bind-fd` cannot directly create
the descriptor-backed read-only mounts used by the Linux sandbox.

## What changed

- Detect `--ro-bind-fd` support when probing system Bubblewrap.
- On older versions, translate descriptor-backed mounts to `/proc/self/fd`
  read-only binds and pass their descriptors and destinations to the trusted
  inner sandbox stage for verification.
- Reject malformed, duplicate, mismatched, or symlink-substituted mounts, and
  close inherited descriptors before running sandboxed code.

## Testing

Added unit coverage for capability detection, legacy argument translation,
invalid mount rejection, inode verification, and descriptor closure.

GitOrigin-RevId: dfc0a457b572cdd9aed093fb5abf57360e9724a2

2026-08-19 04:06:50 +00:00

bazel_bwrap.rs

linux-sandbox: use standalone bundled bwrap (#21255 )

2026-05-05 17:14:29 -07:00

bundled_bwrap.rs

Verify bundled bwrap in Bazel builds (#38494 )

2026-08-14 05:03:39 +00:00

bwrap.rs

Drop capabilities from Linux sandbox processes (#39103 )

2026-08-17 23:21:28 +00:00

exec_util.rs

linux-sandbox: use standalone bundled bwrap (#21255 )