feat(sandbox): add glob deny-read platform enforcement#18096
Merged
viyatb-oai merged 12 commits intomainfrom Apr 17, 2026
Merged
feat(sandbox): add glob deny-read platform enforcement#18096viyatb-oai merged 12 commits intomainfrom
viyatb-oai merged 12 commits intomainfrom
Conversation
This was referenced Apr 16, 2026
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d21044180f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
viyatb-oai
force-pushed
the
codex/viyatb/deny-read-globs-sandbox
branch
2 times, most recently
from
6e2a8c9 to
f74937c
Compare
viyatb-oai
added a commit
that referenced
this pull request
Apr 16, 2026
## Summary
- adds first-class filesystem policy entries for deny-read glob patterns
- parses config such as :project_roots { "**/*.env" = "none" } into
pattern entries
- enforces deny-read patterns in direct read/list helpers
- fails closed for sandbox execution until platform backends enforce
glob patterns in #18096
- preserves split filesystem policy in turn context only when it cannot
be reconstructed from legacy sandbox policy
## Stack
1. This PR - glob deny-read policy/config/direct-tool support
2. #18096 - macOS and Linux sandbox enforcement
3. #17740 - managed deny-read requirements
## Verification
- just fmt
- cargo check -p codex-core -p codex-sandboxing --tests
---------
Co-authored-by: Codex <noreply@openai.com>
viyatb-oai
changed the title
viyatb-oai
force-pushed
the
codex/viyatb/deny-read-globs-sandbox
branch
from
8231409 to
4fac10c
Compare
Add macOS seatbelt regex deny rules and Linux bwrap glob expansion/masking for unreadable filesystem glob patterns. This removes the temporary fail-closed guard from the policy-only layer because both platform backends now enforce the patterns directly. Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Codex noreply@openai.com
Co-authored-by: Codex noreply@openai.com
viyatb-oai
force-pushed
the
codex/viyatb/deny-read-globs-sandbox
branch
from
4fac10c to
2cb6091
Compare
Keep Linux glob expansion working when ripgrep is not available in the test environment, and avoid over-escaping macOS Seatbelt regex deny rules. Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Codex <noreply@openai.com>
Preserve sandbox-denied output for unified exec so deny-read glob failures are returned as normal command output instead of an opaque CreateProcess error. Also canonicalize macOS Seatbelt glob static prefixes so /tmp and /var symlink spellings are masked correctly. Co-authored-by: Codex <noreply@openai.com>
bolinfest
approved these changes
Apr 16, 2026
| None | ||
| } | ||
|
|
||
| #[cfg(test)] |
Collaborator
There was a problem hiding this comment.
In a follow-up, we should also migrate this crate to use the _tests.rs pattern.
Tighten sandbox-denied unified exec output metadata, make glob deny-read tests less flaky, strengthen Linux glob expansion path types, and assert exact Seatbelt regex translations. Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Codex <noreply@openai.com>
Reject Linux bwrap deny-read and read-only carveouts that cross writable symlink components instead of masking a startup-time resolved target. Also rename the glob scan depth config to glob_scan_max_depth. Co-authored-by: Codex <noreply@openai.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
rgis unavailable in minimal or Bazel test environmentsshellandexec_commandwith a**/*.env = nonepolicy and verifies the secret contents do not reach the modelLinux glob expansion
This keeps the common path fast without making sandbox construction depend on an ambient
rgbinary. Ifrgis present but fails for another reason, the sandbox setup fails closed instead of silently omitting deny-read masks.Platform support
mainfrom feat(permissions): add glob deny-read policy support #15979; Windows subprocess sandbox paths continue to fail closed when unreadable split filesystem carveouts require runtime enforcement, rather than silently running unsandboxedStack
Verification
shellandexec_commandglob deny-read enforcementcargo check -p codex-sandboxing -p codex-linux-sandbox --testscargo check -p codex-core --test allcargo clippy -p codex-linux-sandbox -p codex-sandboxing --testsjust bazel-lock-check