fix: support split carveouts in windows elevated sandbox by viyatb-oai · Pull Request #14568 · openai/codex

viyatb-oai · 2026-03-13T08:12:02Z

Summary

preserve legacy Windows elevated sandbox behavior for existing policies
add elevated-only support for split filesystem policies that can be represented as readable-root overrides, writable-root overrides, and extra deny-write carveouts
resolve those elevated filesystem overrides during sandbox transform and thread them through setup and policy refresh
keep failing closed for explicit unreadable (none) carveouts and reopened writable descendants under read-only carveouts
for explicit read-only-under-writable-root carveouts, materialize missing carveout directories during elevated setup before applying the deny-write ACL
document the elevated vs restricted-token support split in the core README

Example

Given a split filesystem policy like:

":root" = "read"
":cwd" = "write"
"./docs" = "read"
"C:/scratch" = "write"

the elevated backend now provisions the readable-root overrides, writable-root overrides, and extra deny-write carveouts during setup and refresh instead of collapsing back to the legacy workspace-only shape.

If a read-only carveout under a writable root is missing at setup time, elevated setup creates that carveout as an empty directory before applying its deny-write ACE; otherwise the sandboxed command could create it later and bypass the carveout. This is only for explicit policy carveouts. Best-effort workspace protections like .codex/ and .agents/ still skip missing directories.

A policy like:

"/workspace" = "write"
"/workspace/docs" = "read"
"/workspace/docs/tmp" = "write"

still fails closed, because the elevated backend does not reopen writable descendants under read-only carveouts yet.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 46da179661

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

) ## Summary - keep legacy Windows restricted-token sandboxing as the supported baseline - support the split-policy subset that restricted-token can enforce directly today - support full-disk read, the same writable root set as legacy `WorkspaceWrite`, and extra read-only carveouts under those writable roots via additional deny-write ACLs - continue to fail closed for unsupported split-only shapes, including explicit unreadable (`none`) carveouts, reopened writable descendants under read-only carveouts, and writable root sets that do not match the legacy workspace roots ## Example Given a filesystem policy like: ```toml ":root" = "read" ":cwd" = "write" "./docs" = "read" ``` the restricted-token backend can keep the workspace writable while denying writes under `docs` by layering an extra deny-write carveout on top of the legacy workspace-write roots. A policy like: ```toml "/workspace" = "write" "/workspace/docs" = "read" "/workspace/docs/tmp" = "write" ``` still fails closed, because the unelevated backend cannot reopen the nested writable descendant safely. ## Stack -> fix: support split carveouts in windows restricted-token sandbox #14172 fix: support split carveouts in windows elevated sandbox #14568

…elevated-permissions-support # Conflicts: # codex-rs/cli/src/debug_sandbox.rs # codex-rs/core/src/exec.rs # codex-rs/windows-sandbox-rs/src/elevated_impl.rs # codex-rs/windows-sandbox-rs/src/identity.rs # codex-rs/windows-sandbox-rs/src/setup_main_win.rs # codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs

Co-authored-by: Codex <noreply@openai.com>

…elevated-permissions-support # Conflicts: # codex-rs/windows-sandbox-rs/src/identity.rs

Co-authored-by: Codex <noreply@openai.com>

…elevated-permissions-support

Co-authored-by: Codex <noreply@openai.com>

…pport

Co-authored-by: Codex <noreply@openai.com>

viyatb-oai mentioned this pull request Mar 13, 2026

fix: support split carveouts in windows restricted-token sandbox #14172

Merged

chatgpt-codex-connector bot reviewed Mar 13, 2026

View reviewed changes

Comment thread codex-rs/core/src/exec.rs Outdated

viyatb-oai requested a review from iceweasel-oai March 13, 2026 16:25

viyatb-oai force-pushed the codex/viyatb/permissions-windows-fail-closed branch from 86c7c4e to 17c89eb Compare March 18, 2026 00:23

viyatb-oai force-pushed the codex/viyatb/windows-elevated-permissions-support branch from 46da179 to aa35d52 Compare March 18, 2026 00:29

viyatb-oai changed the base branch from codex/viyatb/permissions-windows-fail-closed to main March 18, 2026 00:33

viyatb-oai force-pushed the codex/viyatb/windows-elevated-permissions-support branch from aa35d52 to d10d8b5 Compare March 18, 2026 00:36

viyatb-oai changed the base branch from main to codex/viyatb/permissions-windows-fail-closed March 18, 2026 00:36

github-actions bot mentioned this pull request Mar 18, 2026

📊 AI CLI 工具社区动态日报 2026-03-18 gsscsd/big_model_radar#55

Open

bolinfest self-requested a review March 18, 2026 05:50

viyatb-oai force-pushed the codex/viyatb/windows-elevated-permissions-support branch from 980af52 to 3f1c117 Compare March 24, 2026 22:34

Base automatically changed from codex/viyatb/permissions-windows-fail-closed to main March 25, 2026 05:54

viyatb-oai force-pushed the codex/viyatb/windows-elevated-permissions-support branch from 3f1c117 to d30f171 Compare March 25, 2026 06:14

viyatb-oai added 3 commits March 24, 2026 23:17

fix: support split carveouts in windows elevated sandbox

ab18c97

fix: restack elevated windows sandbox support

01617c0

fix: refresh elevated branch exec test callsites

c7b5c90

viyatb-oai force-pushed the codex/viyatb/windows-elevated-permissions-support branch from d30f171 to c7b5c90 Compare March 25, 2026 06:17

fix: refresh windows elevated sandbox debug callsite

da72d73

iceweasel-oai reviewed Mar 25, 2026

View reviewed changes

Comment thread codex-rs/windows-sandbox-rs/src/identity.rs

fix: preserve elevated windows helper read roots

fc4fbd2

viyatb-oai requested a review from iceweasel-oai March 26, 2026 19:53

viyatb-oai and others added 3 commits March 27, 2026 12:16

fix: normalize elevated windows deny carveout matching

e8bbcb4

Co-authored-by: Codex <noreply@openai.com>

fix: borrow elevated windows setup root overrides

5e92cf6

Co-authored-by: Codex <noreply@openai.com>

iceweasel-oai reviewed Mar 27, 2026

View reviewed changes

Comment thread codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs Outdated

Comment thread codex-rs/core/src/exec.rs Outdated

viyatb-oai and others added 3 commits March 27, 2026 12:33

docs: clarify elevated windows read root overrides

af6075a

Co-authored-by: Codex <noreply@openai.com>

fix: remove needless borrows in windows setup overrides

2b7e9ac

Co-authored-by: Codex <noreply@openai.com>

refactor: merge windows sandbox filesystem overrides

2b05255

Co-authored-by: Codex <noreply@openai.com>

viyatb-oai requested a review from iceweasel-oai March 31, 2026 17:54

viyatb-oai and others added 5 commits April 6, 2026 10:07

Merge remote-tracking branch 'origin/main' into codex/viyatb/windows-…

3d69c07

…elevated-permissions-support # Conflicts: # codex-rs/windows-sandbox-rs/src/identity.rs

fix: address windows sandbox clippy

d8c64cb

Co-authored-by: Codex <noreply@openai.com>

Merge remote-tracking branch 'origin/main' into codex/viyatb/windows-…

267052a

…elevated-permissions-support

fix: preserve elevated Windows read overrides

9985804

Co-authored-by: Codex <noreply@openai.com>

Merge branch 'main' into codex/viyatb/windows-elevated-permissions-su…

cf02f58

…pport

iceweasel-oai reviewed Apr 9, 2026

View reviewed changes

Comment thread codex-rs/core/src/exec.rs Outdated

iceweasel-oai approved these changes Apr 9, 2026

View reviewed changes

viyatb-oai and others added 3 commits April 9, 2026 10:26

fix: align Windows sandbox filesystem overrides

e435cc4

Co-authored-by: Codex <noreply@openai.com>

docs: clarify Windows deny-write carveout setup

6c2128c

Co-authored-by: Codex <noreply@openai.com>

docs: specify read-only carveout materialization

2d04216

Co-authored-by: Codex <noreply@openai.com>

viyatb-oai merged commit b976e70 into main Apr 10, 2026
28 of 30 checks passed

viyatb-oai deleted the codex/viyatb/windows-elevated-permissions-support branch April 10, 2026 00:34

github-actions bot locked and limited conversation to collaborators Apr 10, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: support split carveouts in windows elevated sandbox#14568

fix: support split carveouts in windows elevated sandbox#14568
viyatb-oai merged 19 commits intomainfrom
codex/viyatb/windows-elevated-permissions-support

viyatb-oai commented Mar 13, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

viyatb-oai commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Example

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

viyatb-oai commented Mar 13, 2026 •

edited

Loading