Add sandboxed exec-server filesystem helpers#16747
Add sandboxed exec-server filesystem helpers#16747starr-openai wants to merge 9 commits intomainfrom
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 17bb4317da
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| WindowsSandboxLevel::Disabled, | ||
| /*has_managed_network_requirements*/ false, | ||
| ); | ||
| let command = SandboxCommand { | ||
| program: helper_exe.clone().into(), | ||
| args: vec![INTERNAL_FS_OP_FLAG.to_string()], | ||
| cwd: helper_cwd.clone(), | ||
| env: HashMap::new(), | ||
| additional_permissions: None, | ||
| }; | ||
| manager | ||
| .transform(SandboxTransformRequest { | ||
| command, | ||
| policy: &legacy_policy, | ||
| file_system_policy: &effective_file_system_policy, | ||
| network_policy, | ||
| sandbox, | ||
| enforce_managed_network: false, | ||
| network: None, | ||
| sandbox_policy_cwd: helper_cwd.as_path(), | ||
| codex_linux_sandbox_exe: codex_linux_sandbox_exe.as_ref(), | ||
| use_legacy_landlock: false, | ||
| windows_sandbox_level: WindowsSandboxLevel::Disabled, |
There was a problem hiding this comment.
prepare_helper_request hardcodes WindowsSandboxLevel::Disabled when choosing and transforming the sandbox request. On Windows this drives select_initial to SandboxType::None, so *_with_sandbox_policy executes --internal-fs-op without sandboxing even for restricted policies. That silently bypasses requested filesystem restrictions.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in b85bee8c: the sandboxed filesystem helper now uses RestrictedToken for helper-side sandbox selection/transform instead of hardcoding Disabled, so Windows helper execution no longer silently bypasses the requested policy.
1 participant
Summary
codex-exec-server --internal-fs-ophelper process when sandboxing is requestedValidation
dev:cargo test -p codex-exec-server helper_legacy_policy_falls_back_to_external_sandbox_for_direct_runtime_enforcementdev:cargo test -p codex-exec-server file_system && cargo test -p codex-app-server suite::v2::fs