feat: add support for read-only bind mounts in the linux sandbox by viyatb-oai · Pull Request #9112 · openai/codex

viyatb-oai · 2026-01-12T21:04:46Z

Motivation

Landlock alone cannot prevent writes to sensitive in-repo files like .git/ when the repo root is writable, so explicit mount restrictions are required for those paths.
The sandbox must set up any mounts before calling Landlock so Landlock can still be applied afterwards and the two mechanisms compose correctly.

Description

Add a new linux-sandbox helper apply_read_only_mounts in linux-sandbox/src/mounts.rs that: unshares namespaces, maps uids/gids when required, makes mounts private, bind-mounts targets, and remounts them read-only.
Wire the mount step into the sandbox flow by calling apply_read_only_mounts(...) before network/seccomp and before applying Landlock rules in linux-sandbox/src/landlock.rs.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 70efa7f7e8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codex-rs/linux-sandbox/src/mounts.rs

bolinfest

Can we maybe separate the .git -> .git/config && .git/hooks change from the bind mounts stuff and get that in first since I think it's uncontroversial?

codex-rs/linux-sandbox/src/mounts.rs

bolinfest · 2026-01-13T19:58:54Z

@viyatb-oai Also, the suite::seatbelt::if_git_repo_is_writable_root_then_dot_git_folder_is_read_only test failure seems legit.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 70efa7f7e8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codex-rs/linux-sandbox/src/mounts.rs

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f77ddef574

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-01-13T22:36:16Z

codex-rs/linux-sandbox/src/mounts.rs

+    if is_running_as_root() {
+        unshare_mount_namespace()?;
+    } else {
+        unshare_user_and_mount_namespaces()?;
+        write_user_namespace_maps()?;


Handle hosts without unprivileged user namespaces

On non‑root runs this unconditionally calls unshare(CLONE_NEWUSER|CLONE_NEWNS) and bails on failure. On hosts where unprivileged user namespaces are disabled (e.g., kernel.unprivileged_userns_clone=0 or container runtimes that block CLONE_NEWUSER), that returns EPERM/ENOSYS, so the sandbox now aborts before applying Landlock even though Landlock‑only would still work. That’s an availability regression for workspace‑write in those environments; consider falling back to Landlock‑only or skipping the mount step when user‑namespace unshare fails.

Useful? React with 👍 / 👎.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 15bac577ed

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-01-13T23:12:05Z

codex-rs/linux-sandbox/src/mounts.rs

+    // Drop ambient capabilities acquired from the user namespace so the
+    // sandboxed command cannot remount or create new bind mounts.
+    if !is_running_as_root() {
+        drop_caps()?;


Drop CAP_SYS_ADMIN even when running as root

When codex-linux-sandbox is launched as root (common in containerized CI), this branch skips drop_caps, so the sandboxed command keeps CAP_SYS_ADMIN in the host user namespace and can remount the read‑only bind mounts as read‑write, undoing the new .git protection. This means the read‑only mount enforcement only works for non‑root runs; consider dropping capabilities (or switching to an unprivileged UID) even when is_running_as_root() is true.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-01-13T23:12:05Z

codex-rs/linux-sandbox/tests/suite/landlock.rs

+    let sandbox_program = env!("CARGO_BIN_EXE_codex-linux-sandbox");
+    let codex_linux_sandbox_exe = Some(PathBuf::from(sandbox_program));


Use absolute cargo_bin path for sandbox binary

The test pulls the sandbox binary path from CARGO_BIN_EXE_*, which is project‑relative under Buck2; if the test runs with a working directory outside the repo root, process_exec_tool_call will fail to spawn the binary and the test will panic even though the sandbox is fine. Prefer codex_utils_cargo_bin::cargo_bin("codex-linux-sandbox") to resolve an absolute path and keep Buck2 runs stable.

Useful? React with 👍 / 👎.

bolinfest

This is looking really good!

codex-rs/linux-sandbox/src/mounts.rs

bolinfest · 2026-01-14T02:55:41Z

codex-rs/linux-sandbox/src/mounts.rs

+            // Worktrees and submodules store `.git` as a pointer file; add the
+            // referenced gitdir as an extra read-only target.
+            if is_git_pointer_file(ro_subpath) {
+                let gitdir = resolve_gitdir_from_file(ro_subpath)?;


Does it matter if gitdir is under another writable root or not? I believe this would matter in Seatbelt because of how (require-all) works there?

codex-rs/protocol/src/protocol.rs

codex-rs/linux-sandbox/tests/suite/landlock.rs

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7c74e970d2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-01-14T04:20:09Z

codex-rs/linux-sandbox/src/mounts.rs

+            if is_git_pointer_file(ro_subpath) {
+                let gitdir = resolve_gitdir_from_file(ro_subpath)?;


Treat non-pointer .git files as read-only, not fatal

This path treats any .git file as a worktree pointer and immediately errors if resolve_gitdir_from_file can’t parse gitdir: <path>. That means a workspace that happens to contain a regular .git file (or a corrupted worktree pointer) will now fail to start the sandbox, even though the .git file itself could still be safely bind‑mounted read‑only and the command could proceed. This is a new availability regression for non‑Git directories or damaged worktrees; consider skipping gitdir resolution (or logging) when the file doesn’t match the expected pointer format instead of aborting.

Useful? React with 👍 / 👎.

bolinfest

Amazing work here!

Add git hook/config mount protections

70efa7f

viyatb-oai added the codex label Jan 12, 2026 — with ChatGPT Codex Connector

viyatb-oai marked this pull request as draft January 12, 2026 21:05

chatgpt-codex-connector bot reviewed Jan 12, 2026

View reviewed changes

codex-rs/linux-sandbox/src/mounts.rs Outdated Show resolved Hide resolved

bolinfest reviewed Jan 13, 2026

View reviewed changes

codex-rs/linux-sandbox/src/mounts.rs Show resolved Hide resolved

codex-rs/linux-sandbox/src/mounts.rs Outdated Show resolved Hide resolved

viyatb-oai marked this pull request as ready for review January 13, 2026 21:44

chatgpt-codex-connector bot reviewed Jan 13, 2026

View reviewed changes

codex-rs/linux-sandbox/src/mounts.rs Show resolved Hide resolved

viyatb-oai added 2 commits January 13, 2026 14:26

Protect full .git and handle gitdir files

423d17f

Add gitdir notes and mount docs

f77ddef

viyatb-oai changed the title ~~Add read-only bind mounts for .git/hooks and .git/config in Linux sandbox~~ feat: add support for read-only bind mounts for linux sandbox Jan 13, 2026

chatgpt-codex-connector bot reviewed Jan 13, 2026

View reviewed changes

viyatb-oai added 2 commits January 13, 2026 14:49

Drop caps after mount setup

467fdea

Add git mount protection tests

15bac57

chatgpt-codex-connector bot reviewed Jan 13, 2026

View reviewed changes

viyatb-oai added 2 commits January 13, 2026 17:38

Fix linux-sandbox capset on musl

e8bce50

Silence unwrap clippy in landlock tests

20c7bf2

bolinfest reviewed Jan 14, 2026

View reviewed changes

viyatb-oai changed the title ~~feat: add support for read-only bind mounts for linux sandbox~~ feat: add support for read-only bind mounts in the linux sandbox Jan 14, 2026

viyatb-oai added 3 commits January 13, 2026 19:46

Protect git pointer files across sandboxes

3e9e894

Document sandbox read-only paths

1e57f36

Format protocol gitdir handling

7c74e97

chatgpt-codex-connector bot reviewed Jan 14, 2026

View reviewed changes

bolinfest approved these changes Jan 14, 2026

View reviewed changes

bolinfest merged commit e1447c3 into main Jan 14, 2026
32 checks passed

bolinfest deleted the codex/create-rust-cli-tool-for-git-path-restrictions branch January 14, 2026 16:30

github-actions bot locked and limited conversation to collaborators Jan 14, 2026

		let sandbox_program = env!("CARGO_BIN_EXE_codex-linux-sandbox");
		let codex_linux_sandbox_exe = Some(PathBuf::from(sandbox_program));

		if is_git_pointer_file(ro_subpath) {
		let gitdir = resolve_gitdir_from_file(ro_subpath)?;

Conversation

viyatb-oai commented Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Description

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

bolinfest left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

bolinfest commented Jan 13, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector bot Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

bolinfest left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bolinfest Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

bolinfest left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

viyatb-oai commented Jan 12, 2026 •

edited

Loading