seatbelt: honor split filesystem sandbox policies by bolinfest · Pull Request #13448 · openai/codex

bolinfest · 2026-03-04T09:24:29Z

Why

After #13440 and #13445, macOS Seatbelt policy generation was still deriving filesystem and network behavior from the legacy SandboxPolicy projection.

That projection loses explicit unreadable carveouts and conflates split network decisions, so the generated Seatbelt policy could still be wider than the split policy that Codex had already computed.

What changed

added Seatbelt entrypoints that accept FileSystemSandboxPolicy and NetworkSandboxPolicy directly
built read and write policy stanzas from access roots plus excluded subpaths so explicit unreadable carveouts survive into the generated Seatbelt policy
switched network policy generation to consult NetworkSandboxPolicy directly
failed closed when managed-network or proxy-constrained sessions do not yield usable loopback proxy endpoints
updated the macOS callers and test helpers that now need to carry the split policies explicitly

Verification

added regression coverage in core/src/seatbelt.rs for unreadable carveouts under both full-disk and scoped-readable policies
verified the current PR state with just clippy

Stack created with Sapling. Best reviewed with ReviewStack.

chatgpt-codex-connector · 2026-03-04T09:36:25Z

💡 Codex Review

codex/codex-rs/core/src/sandboxing/mod.rs

Lines 357 to 359 in c3b03c7

    
           FileSystemSandboxKind::Restricted => { 
        
               FileSystemSandboxPolicy::from(&effective_policy) 
        
           }

Preserve denied subpaths when merging additional permissions

When additional permissions include any extra read/write roots, this branch rebuilds the filesystem policy from effective_policy (legacy SandboxPolicy), which cannot encode FileSystemAccessMode::None carveouts. As a result, explicit unreadable paths from the original split policy are dropped, so a command that requests unrelated extra access can regain access to paths that were explicitly denied (for example, a blocked subdirectory under the workspace) and run with a wider sandbox than configured.

codex/codex-rs/core/src/exec.rs

Lines 168 to 169 in c3b03c7

    
           let sandbox_type = match file_system_sandbox_policy.kind { 
        
               FileSystemSandboxKind::Unrestricted | FileSystemSandboxKind::ExternalSandbox => {

Skip platform sandbox for full-access restricted filesystem policy

This selection logic keys only on file_system_sandbox_policy.kind, so profiles expressed as restricted entries with :root = "write" are treated as sandbox-required even though they already grant full disk write access (legacy projection becomes DangerFullAccess/ExternalSandbox). On Linux setups where codex_linux_sandbox_exe is not present, that forces the Linux sandbox path and can fail with MissingLinuxSandboxExecutable instead of running normally, which makes valid full-access profiles unexpectedly break.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

## Why `#13434` introduces split `FileSystemSandboxPolicy` and `NetworkSandboxPolicy`, but the runtime still made most execution-time sandbox decisions from the legacy `SandboxPolicy` projection. That projection loses information about combinations like unrestricted filesystem access with restricted network access. In practice, that means the runtime can choose the wrong platform sandbox behavior or set the wrong network-restriction environment for a command even when config has already separated those concerns. This PR carries the split policies through the runtime so sandbox selection, process spawning, and exec handling can consult the policy that actually matters. ## What changed - threaded `FileSystemSandboxPolicy` and `NetworkSandboxPolicy` through `TurnContext`, `ExecRequest`, sandbox attempts, shell escalation state, unified exec, and app-server exec overrides - updated sandbox selection in `core/src/sandboxing/mod.rs` and `core/src/exec.rs` to key off `FileSystemSandboxPolicy.kind` plus `NetworkSandboxPolicy`, rather than inferring behavior only from the legacy `SandboxPolicy` - updated process spawning in `core/src/spawn.rs` and the platform wrappers to use `NetworkSandboxPolicy` when deciding whether to set `CODEX_SANDBOX_NETWORK_DISABLED` - kept additional-permissions handling and legacy `ExternalSandbox` compatibility projections aligned with the split policies, including explicit user-shell execution and Windows restricted-token routing - updated callers across `core`, `app-server`, and `linux-sandbox` to pass the split policies explicitly ## Verification - added regression coverage in `core/tests/suite/user_shell_cmd.rs` to verify `RunUserShellCommand` does not inherit `CODEX_SANDBOX_NETWORK_DISABLED` from the active turn - added coverage in `core/src/exec.rs` for Windows restricted-token sandbox selection when the legacy projection is `ExternalSandbox` - updated Linux sandbox coverage in `linux-sandbox/tests/suite/landlock.rs` to exercise the split-policy exec path - verified the current PR state with `just clippy` --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/openai/codex/pull/13439). * #13453 * #13452 * #13451 * #13449 * #13448 * #13445 * #13440 * __->__ #13439 --------- Co-authored-by: viyatb-oai <viyatb@openai.com>

## Why `#13434` and `#13439` introduce split filesystem and network policies, but the only code that could answer basic filesystem questions like "is access effectively unrestricted?" or "which roots are readable and writable for this cwd?" still lived on the legacy `SandboxPolicy` path. That would force later backends to either keep projecting through `SandboxPolicy` or duplicate path-resolution logic. This PR moves those queries onto `FileSystemSandboxPolicy` itself so later runtime and platform changes can consume the split policy directly. ## What changed - added `FileSystemSandboxPolicy` helpers for full-read/full-write checks, platform-default reads, readable roots, writable roots, and explicit unreadable roots resolved against a cwd - added a shared helper for the default read-only carveouts under writable roots so the legacy and split-policy paths stay aligned - added protocol coverage for full-access detection and derived readable, writable, and unreadable roots ## Verification - added protocol coverage in `protocol/src/protocol.rs` and `protocol/src/permissions.rs` for full-root access and derived filesystem roots - verified the current PR state with `just clippy` --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/openai/codex/pull/13440). * #13453 * #13452 * #13451 * #13449 * #13448 * #13445 * __->__ #13440 * #13439 --------- Co-authored-by: viyatb-oai <viyatb@openai.com>

## Why `apply_patch` safety approval was still checking writable paths through the legacy `SandboxPolicy` projection. That can hide explicit `none` carveouts when a split filesystem policy projects back to compatibility `ExternalSandbox`, which leaves one more approval path that can auto-approve writes inside paths that are intentionally blocked. ## What changed - passed `turn.file_system_sandbox_policy` into `assess_patch_safety` - changed writable-path checks to derive effective access from `FileSystemSandboxPolicy` instead of the legacy `SandboxPolicy` - made those checks reject explicit unreadable roots before considering broad write access or writable roots - added regression coverage showing that an `ExternalSandbox` compatibility projection still asks for approval when the split filesystem policy blocks a subpath ## Verification - `cargo test -p codex-core safety::tests::` - `cargo test -p codex-core test_sandbox_config_parsing` - `cargo clippy -p codex-core --all-targets -- -D warnings` --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/openai/codex/pull/13445). * #13453 * #13452 * #13451 * #13449 * #13448 * __->__ #13445 * #13440 * #13439 --------- Co-authored-by: viyatb-oai <viyatb@openai.com>

dylan-hurd-oai · 2026-03-07T19:48:11Z

@codex review

dylan-hurd-oai

1 non-blocking comment from me, but also let's see what codex says about the current version 😄

dylan-hurd-oai · 2026-03-07T19:21:13Z

codex-rs/core/src/seatbelt.rs

+        Ok(path) => path,
+        Err(err) => panic!("root path must be absolute: {err}"),
+    }
+}


This should probably be a method on AbsolutePathBuf?

probably but we only use it here in seatbelt. trying to reduce number of edits outside this file :(

bolinfest changed the base branch from main to pr13445 March 4, 2026 09:24

bolinfest mentioned this pull request Mar 4, 2026

linux-sandbox: plumb split sandbox policies through helper #13449

Merged

bolinfest force-pushed the pr13448 branch from c3b03c7 to ed7a864 Compare March 4, 2026 09:47

bolinfest force-pushed the pr13445 branch from 3244ffd to 1434bba Compare March 4, 2026 09:47

This was referenced Mar 4, 2026

sandboxing: preserve denied paths when widening permissions #13451

Merged

linux-sandbox: honor split filesystem policies in bwrap #13453

Merged

protocol: keep root carveouts sandboxed #13452

Merged

bolinfest force-pushed the pr13448 branch from ed7a864 to ab133b0 Compare March 6, 2026 18:12

bolinfest force-pushed the pr13445 branch from 0e95cf5 to a6a9651 Compare March 6, 2026 19:04

bolinfest force-pushed the pr13448 branch 2 times, most recently from 3e354ad to 6f31748 Compare March 6, 2026 19:35

bolinfest force-pushed the pr13445 branch from 11575e0 to b9614d6 Compare March 6, 2026 20:02

bolinfest force-pushed the pr13448 branch from 6f31748 to 9f2ff9f Compare March 6, 2026 20:02

bolinfest force-pushed the pr13445 branch from b9614d6 to da1d510 Compare March 6, 2026 20:19

bolinfest force-pushed the pr13448 branch from 9f2ff9f to 4a8859f Compare March 6, 2026 20:19

bolinfest force-pushed the pr13445 branch from da1d510 to e919dba Compare March 6, 2026 20:27

bolinfest force-pushed the pr13448 branch 2 times, most recently from f0f11de to 8451b47 Compare March 6, 2026 21:03

bolinfest force-pushed the pr13445 branch 2 times, most recently from b1aa31b to 3cec98b Compare March 6, 2026 21:32

bolinfest force-pushed the pr13448 branch from 8451b47 to 6888940 Compare March 6, 2026 21:32

bolinfest force-pushed the pr13445 branch from 3cec98b to f2323ca Compare March 6, 2026 22:33

bolinfest force-pushed the pr13448 branch 2 times, most recently from 42b9605 to a796513 Compare March 6, 2026 22:45

bolinfest force-pushed the pr13448 branch from 6b8740e to 3744e54 Compare March 6, 2026 23:54

bolinfest force-pushed the pr13445 branch 2 times, most recently from 25dfa21 to b8b3565 Compare March 7, 2026 00:15

bolinfest force-pushed the pr13448 branch from 3744e54 to 60e0188 Compare March 7, 2026 00:15

github-actions bot mentioned this pull request Mar 7, 2026

📊 AI CLI 工具社区动态日报 2026-03-07 duanyytop/agents-radar#88

Open

bolinfest added 4 commits March 6, 2026 16:23

sandboxing: plumb split sandbox policies through runtime

a065a40

protocol: derive effective file access from filesystem policies

8a70b18

safety: honor filesystem policy carveouts in apply_patch

fd42996

seatbelt: honor split filesystem sandbox policies

e24e36e

bolinfest force-pushed the pr13448 branch from 60e0188 to e24e36e Compare March 7, 2026 00:25

bolinfest force-pushed the pr13445 branch from b8b3565 to fd42996 Compare March 7, 2026 00:25

Base automatically changed from pr13445 to main March 7, 2026 08:01

viyatb-oai added 2 commits March 7, 2026 00:22

chore: merge origin/main into pr13448

a7d23b0

chore(app-server-protocol): revert schema whitespace cleanup

1cb1d43

viyatb-oai requested a review from dylan-hurd-oai March 7, 2026 08:50

viyatb-oai added 2 commits March 7, 2026 01:16

refactor(core): remove extra seatbelt wrapper

fc7f30b

refactor(core): inline seatbelt policy helper

6b56da7

github-actions bot mentioned this pull request Mar 7, 2026

📊 AI CLI 工具社区动态日报 2026-03-07 compasify/agents-radar#4

Open

test(core): align macos request permissions expectations

f3be072

dylan-hurd-oai approved these changes Mar 7, 2026

View reviewed changes

Merge remote-tracking branch 'origin/main' into pr13448

c2fd525

viyatb-oai enabled auto-merge (squash) March 8, 2026 00:21

github-actions bot mentioned this pull request Mar 8, 2026

📊 AI CLI 工具社区动态日报 2026-03-08 duanyytop/agents-radar#95

Open

viyatb-oai merged commit bf5c2f4 into main Mar 8, 2026
70 of 75 checks passed

viyatb-oai deleted the pr13448 branch March 8, 2026 00:35

github-actions bot locked and limited conversation to collaborators Mar 8, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

seatbelt: honor split filesystem sandbox policies#13448

seatbelt: honor split filesystem sandbox policies#13448
viyatb-oai merged 10 commits intomainfrom
pr13448

bolinfest commented Mar 4, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector bot commented Mar 4, 2026

Uh oh!

dylan-hurd-oai commented Mar 7, 2026

Uh oh!

dylan-hurd-oai left a comment

Uh oh!

dylan-hurd-oai Mar 7, 2026

Uh oh!

viyatb-oai Mar 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

bolinfest commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What changed

Verification

Uh oh!

chatgpt-codex-connector bot commented Mar 4, 2026

💡 Codex Review

Uh oh!

dylan-hurd-oai commented Mar 7, 2026

Uh oh!

dylan-hurd-oai left a comment

Choose a reason for hiding this comment

Uh oh!

dylan-hurd-oai Mar 7, 2026

Choose a reason for hiding this comment

Uh oh!

viyatb-oai Mar 7, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

bolinfest commented Mar 4, 2026 •

edited

Loading