Linux: build the view, then seccomp, then exec

A teammate runs Codex on a Mac; the agent reads ~/.ssh/id_rsa; Seatbelt returns Operation not permitted at once. Put the same repo on a Linux laptop and the usual copy becomes No such file or directory. The path is often not in the mounts at all.

If you set PR_SET_NO_NEW_PRIVS first, then call the distro’s own bwrap, the setuid binary on many distros will not even start. The sandbox fails on the machine that has everything installed. seccomp is a kernel filter that says which syscalls the process may still make; no_new_privs is its precondition, and it also blocks setuid privilege gain.

The default path enters the same helper twice. The outer pass only builds bubblewrap, swaps the filesystem to default read-only, then layers writable roots; .git, .agents, and .codex stay read-only even when they sit inside a writable root. The inner pass then sets no_new_privs, installs network seccomp, forks, and hands the process image to the user command.

The function header writes the order as three steps:

/// Entry point for the Linux sandbox helper.
///
/// The sequence is:
/// 1. When needed, wrap the command with bubblewrap to construct the
///    filesystem view.
/// 2. Apply in-process restrictions (no_new_privs + seccomp).
/// 3. `execvp` into the final command.

A field comment puts the reason on the flag: bubblewrap may depend on setuid, so build the view first, then tighten.Source: codex-rs/linux-sandbox/src/linux_run_main.rs lines 117–121；codex-rs/linux-sandbox/src/landlock.rs lines 57–65

What you can see, and which syscalls you can make, are two walls. Swap the world first, then tighten calls. Rewrite it in another language: as long as distros still ship a setuid wrapper, this order still holds.

bubblewrap and seccomp must happen in the process that is about to become the user command. If the main CLI unshares and execs itself, a failure takes the whole session with it, and you cannot leave a PID-1 reaper in the PID namespace. Timeouts and cancels leave sleeping processes behind.

Linux looks at the basename of argv[0]. If the filename is already codex-linux-sandbox, keep it; otherwise rewrite it to that alias and steer the same binary into the helper. The outer exec is not ls; it is the helper itself, with --apply-seccomp-then-exec. The launcher also inserts --as-pid-1 so bubblewrap itself is PID 1 in the namespace.

The inner pass starts with capget. If effective or permitted is nonzero, it panics at once; the command never runs. Only after that check does it fork. The child execvps; the parent waitpid(-1) reaps descendants and forwards the exit code as-is.Source: codex-rs/linux-sandbox/src/linux_run_main.rs lines 216–221、lines 242–243；codex-rs/linux-sandbox/src/launcher.rs lines 38–39

A dedicated helper plus wrap-then-tighten is the same family of self-invocation across platforms. Windows looks at a hidden flag; Linux looks at arg0. When the wrapper fails, a fixed exit code plus a fixed stderr prefix is easier to attribute automatically.

The type is still named LandlockCommand, and the crate directory is still linux-sandbox, so plenty of write-ups say Codex uses Landlock on Linux. The current default filesystem sandbox is already bubblewrap. Landlock is an explicit legacy fallback; the feature flag is marked Deprecated and off by default. Legacy cannot express restricted read, and cannot express nested read-only that was split out.

If bwrap fails and silently switches to Landlock, the model plans as if “I am locked in a view,” while it can still see the host file tree. The next step forks.

The outer pass writes never falls back. bubblewrap failure is failure. On WSL1, when bubblewrap is required, transform returns Wsl1UnsupportedForBubblewrap and the command never enters the helper. When the disk is fully writable and no proxy is used, bwrap is not entered at all, so WSL1 can pass. A user namespace that cannot be built becomes a startup warning; it does not switch to a weaker backend.Source: codex-rs/linux-sandbox/src/linux_run_main.rs lines 290–294；codex-rs/sandboxing/src/manager.rs lines 413–420、lines 696–710；codex-rs/features/src/lib.rs lines 1064–1069

When platforms are unequal, the easy mistake is covering every Linux with “we have a Linux sandbox.” A laptop with a new bwrap, a CI container that banned user namespaces, a teammate still on WSL1 — three machines, not one wall. Product copy and the model brief must be written against the layer that is actually on.