Linux restricted-read permission profiles silently accept writes via ephemeral tmpfs

Start at the codex sandbox CLI entry point and reproduce the restricted-read profile behavior on Linux with the non-interactive shell script described in the issue. Trace how the ephemeral tmpfs is configured and verify that attempted writes are rejected rather than silently accepted; add or update coverage for this regression if the existing sandbox tests expose the relevant path.

What version of Codex CLI is running?

0.146.0

What subscription do you have?

Plus

Which model were you using?

Not relevant — this is a local CLI sandbox issue and reproduces with codex sandbox without invoking a model.

What platform is your computer?

Linux 5.15.0-185-generic x86_64 x86_64

What terminal emulator and version are you using (if applicable)?

Not relevant — reproduced by a non-interactive shell script using codex sandbox; no terminal emulator or multiplexer is involved.

Codex doctor report

{
  "schemaVersion": 1,
  "generatedAt": "1785825346s since unix epoch",
  "overallStatus": "ok",
  "codexVersion": "0.146.0",
  "checks": {
    "app_server.status": {
      "id": "app_server.status",
      "category": "app-server",
      "status": "ok",
      "summary": "background server is not running",
      "details": {
        "control socket": "/home/gds/.codex/app-server-control/app-server-control.sock",
        "daemon state dir": "/home/gds/.codex/app-server-daemon",
        "mode": "ephemeral",
        "pid file": "/home/gds/.codex/app-server-daemon/app-server.pid (missing)",
        "settings": "/home/gds/.codex/app-server-daemon/settings.json (missing)",
        "status": "not running",
        "update-loop pid file": "/home/gds/.codex/app-server-daemon/app-server-updater.pid (missing)"
      },
      "remediation": null,
      "durationMs": 0
    },
    "auth.credentials": {
      "id": "auth.credentials",
      "category": "auth",
      "status": "ok",
      "summary": "auth is configured",
      "details": {
        "auth file": "/home/gds/.codex/auth.json",
        "auth storage mode": "File",
        "stored API key": "false",
        "stored ChatGPT tokens": "true",
        "stored agent identity": "false",
        "stored auth mode": "chatgpt"
      },
      "remediation": null,
      "durationMs": 0
    },
    "config.load": {
      "id": "config.load",
      "category": "config",
      "status": "ok",
      "summary": "config loaded",
      "details": {
        "CODEX_HOME": "/home/gds/.codex",
        "config.toml": "/home/gds/.codex/config.toml",
        "config.toml parse": "ok",
        "cwd": "/home/gds",
        "enabled feature flags": "shell_tool, unified_exec, shell_snapshot, code_mode_host, terminal_resize_reflow, sqlite, hooks, enable_request_compression, multi_agent, apps, tool_search_always_defer_mcp_tools, tool_suggest, plugins, in_app_browser, in_app_updates, browser_use, browser_use_full_cdp_access, browser_use_external, computer_use, remote_plugin, plugin_sharing, image_generation, resize_all_images, item_ids, skill_mcp_dependency_install, skill_search, mentions_v2, steer, guardian_approval, goals, collaboration_modes, tool_call_mcp_elicitation, auth_elicitation, personality, fast_mode, tui_app_server, prevent_idle_sleep, remote_compaction_v2, workspace_dependencies",
        "feature flag overrides": "prevent_idle_sleep=true",
        "feature flags enabled": "39",
        "log dir": "/home/gds/.codex/log",
        "mcp servers": "1",
        "model": "gpt-5.6-sol",
        "model provider": "openai",
        "sqlite home": "/home/gds/.codex"
      },
      "remediation": null,
      "durationMs": 0
    },
    "git.environment": {
      "id": "git.environment",
      "category": "git",
      "status": "ok",
      "summary": "git version 2.34.1",
      "details": {
        ".git entry": "directory",
        "PATH git #1": "/usr/bin/git",
        "PATH git #2": "/bin/git",
        "PATH git entries": "2",
        "git branch": "conf",
        "git build options": "git version 2.34.1; cpu: x86_64; no commit associated with this build; sizeof-long: 8; sizeof-size_t: 8; shell-path: /bin/sh",
        "git exec path": "/usr/lib/git-core",
        "git version": "git version 2.34.1",
        "repo detected": "true",
        "repo root": "/home/gds",
        "selected git": "/usr/bin/git"
      },
      "remediation": null,
      "durationMs": 113
    },
    "installation": {
      "id": "installation",
      "category": "install",
      "status": "ok",
      "summary": "installation looks consistent",
      "details": {
        "PATH codex #1": "/home/gds/.config/nvm/versions/node/v24.16.0/bin/codex",
        "current executable": "/home/gds/.config/nvm/versions/node/v24.16.0/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/bin/codex",
        "install context": "npm (package /home/gds/.config/nvm/versions/node/v24.16.0/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl, bin /home/gds/.config/nvm/versions/node/v24.16.0/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/bin, resources /home/gds/.config/nvm/versions/node/v24.16.0/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/codex-resources, path /home/gds/.config/nvm/versions/node/v24.16.0/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/codex-path)",
        "managed by bun": "false",
        "managed by npm": "true",
        "managed by pnpm": "false",
        "managed package root": "/home/gds/.config/nvm/versions/node/v24.16.0/lib/node_modules/@openai/codex",
        "npm update target": "/home/gds/.config/nvm/versions/node/v24.16.0/lib/node_modules/@openai/codex"
      },
      "remediation": null,
      "durationMs": 73
    },
    "mcp.config": {
      "id": "mcp.config",
      "category": "mcp",
      "status": "ok",
      "summary": "MCP configuration is locally consistent",
      "details": {
        "configured servers": "1",
        "disabled servers": "0",
        "streamable_http servers": "1"
      },
      "remediation": null,
      "durationMs": 402
    },
    "network.env": {
      "id": "network.env",
      "category": "network",
      "status": "ok",
      "summary": "network-related environment looks readable",
      "details": {
        "proxy env vars": "none"
      },
      "remediation": null,
      "durationMs": 0
    },
    "network.provider_reachability": {
      "id": "network.provider_reachability",
      "category": "reachability",
      "status": "ok",
      "summary": "active provider endpoints are reachable over HTTP",
      "details": {
        "ChatGPT base URL": "https://chatgpt.com/backend-api/ reachable (HTTP 404)",
        "reachability mode": "ChatGPT auth"
      },
      "remediation": null,
      "durationMs": 206
    },
    "network.websocket_reachability": {
      "id": "network.websocket_reachability",
      "category": "websocket",
      "status": "ok",
      "summary": "Responses WebSocket handshake succeeded",
      "details": {
        "DNS": "2 IPv4, 2 IPv6, first IPv4",
        "auth mode": "chatgpt",
        "connect timeout": "15000 ms",
        "endpoint": "wss://chatgpt.com/backend-api/<redacted>",
        "handshake result": "HTTP 101 Switching Protocols",
        "model provider": "openai",
        "models etag present": "true",
        "provider name": "OpenAI",
        "proxy env vars": "none",
        "reasoning header": "false",
        "server model present": "false",
        "supports websockets": "true",
        "wire API": "responses"
      },
      "remediation": null,
      "durationMs": 765
    },
    "runtime.provenance": {
      "id": "runtime.provenance",
      "category": "runtime",
      "status": "ok",
      "summary": "running npm on linux-x86_64",
      "details": {
        "commit": "unknown",
        "current executable": "/home/gds/.config/nvm/versions/node/v24.16.0/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/bin/codex",
        "install method": "npm (package /home/gds/.config/nvm/versions/node/v24.16.0/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl, bin /home/gds/.config/nvm/versions/node/v24.16.0/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/bin, resources /home/gds/.config/nvm/versions/node/v24.16.0/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/codex-resources, path /home/gds/.config/nvm/versions/node/v24.16.0/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/codex-path)",
        "platform": "linux-x86_64",
        "version": "0.146.0"
      },
      "remediation": null,
      "durationMs": 0
    },
    "runtime.search": {
      "id": "runtime.search",
      "category": "search",
      "status": "ok",
      "summary": "search is OK (bundled)",
      "details": {
        "search command": "/home/gds/.config/nvm/versions/node/v24.16.0/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/codex-path/rg",
        "search command readiness": "file exists",
        "search provider": "bundled"
      },
      "remediation": null,
      "durationMs": 0
    },
    "sandbox.helpers": {
      "id": "sandbox.helpers",
      "category": "sandbox",
      "status": "ok",
      "summary": "sandbox configuration is readable",
      "details": {
        "approval policy": "OnRequest",
        "codex-linux-sandbox helper": "/home/gds/.codex/tmp/arg0/codex-arg0iohdc3/codex-linux-sandbox",
        "execve wrapper helper": "/home/gds/.codex/tmp/arg0/codex-arg0iohdc3/codex-execve-wrapper",
        "filesystem sandbox": "restricted",
        "network sandbox": "enabled"
      },
      "remediation": null,
      "durationMs": 0
    },
    "state.paths": {
      "id": "state.paths",
      "category": "state",
      "status": "ok",
      "summary": "state paths and databases are inspectable",
      "details": {
        "CODEX_HOME": "/home/gds/.codex (dir)",
        "active rollout files": "216 files, 152064594 total bytes, 704002 average bytes",
        "archived rollout files": "0 files, 0 total bytes, 0 average bytes",
        "goals DB": "/home/gds/.codex/goals_1.sqlite (file)",
        "goals DB integrity": "ok",
        "log DB": "/home/gds/.codex/logs_2.sqlite (file)",
        "log DB integrity": "ok",
        "log dir": "/home/gds/.codex/log (dir)",
        "memories DB": "/home/gds/.codex/memories_1.sqlite (file)",
        "memories DB integrity": "ok",
        "sqlite home": "/home/gds/.codex (dir)",
        "state DB": "/home/gds/.codex/state_5.sqlite (file)",
        "state DB integrity": "ok",
        "thread history DB": "/home/gds/.codex/thread_history_1.sqlite (missing)",
        "thread history DB integrity": "skipped (missing)"
      },
      "remediation": null,
      "durationMs": 444
    },
    "state.rollout_db_parity": {
      "id": "state.rollout_db_parity",
      "category": "threads",
      "status": "ok",
      "summary": "rollout files and state DB thread inventory agree",
      "details": {
        "default model provider": "openai",
        "rollout DB active files": "216",
        "rollout DB active rows": "216",
        "rollout DB archive mismatches": "0",
        "rollout DB archived files": "0",
        "rollout DB archived rows": "0",
        "rollout DB duplicate DB paths": "0",
        "rollout DB duplicate rollout thread ids": "0",
        "rollout DB malformed file names": "0",
        "rollout DB missing active rows": "0",
        "rollout DB missing archived rows": "0",
        "rollout DB model providers": "openai=216",
        "rollout DB rows": "216",
        "rollout DB scan cap reached": "false",
        "rollout DB scan errors": "0",
        "rollout DB sources": "cli=163, subagent:thread_spawn=53",
        "rollout DB stale rows": "0"
      },
      "remediation": null,
      "durationMs": 167
    },
    "system.environment": {
      "id": "system.environment",
      "category": "system",
      "status": "ok",
      "summary": "OS language en-US",
      "details": {
        "EDITOR": "set",
        "LANG": "en_US.UTF-8",
        "LC_ALL": "en_US.UTF-8",
        "VISUAL": "not set",
        "os": "Ubuntu 22.4.0 (jammy) [64-bit]",
        "os language": "en-US",
        "os type": "Ubuntu",
        "os version": "22.4.0"
      },
      "remediation": null,
      "durationMs": 43
    },
    "terminal.env": {
      "id": "terminal.env",
      "category": "terminal",
      "status": "ok",
      "summary": "terminal metadata was detected",
      "details": {
        "COLORTERM": "truecolor",
        "DISPLAY": "present",
        "color output": "disabled (stdout is not a terminal)",
        "effective locale": "en_US.UTF-8",
        "stderr is terminal": "true",
        "stdin is terminal": "true",
        "stdout is terminal": "false",
        "terminal": "Alacritty",
        "terminal size": "100x32"
      },
      "remediation": null,
      "durationMs": 0
    },
    "terminal.title": {
      "id": "terminal.title",
      "category": "title",
      "status": "ok",
      "summary": "terminal title configured",
      "details": {
        "terminal title activity": "true",
        "terminal title items": "activity, project-name, thread-title",
        "terminal title project source": "git repo root",
        "terminal title project value": "gds",
        "terminal title source": "configured"
      },
      "remediation": null,
      "durationMs": 0
    },
    "updates.status": {
      "id": "updates.status",
      "category": "updates",
      "status": "ok",
      "summary": "update configuration is locally consistent",
      "details": {
        "cached latest version": "0.146.0",
        "check for update on startup": "true",
        "last checked at": "2026-08-04T04:19:11.083655714Z",
        "latest version": "0.146.0",
        "latest version status": "current version is not older",
        "npm update target": "/home/gds/.config/nvm/versions/node/v24.16.0/lib/node_modules/@openai/codex",
        "update action": "npm install -g @openai/codex",
        "version cache": "/home/gds/.codex/version.json"
      },
      "remediation": null,
      "durationMs": 495
    }
  }
}

What issue are you seeing?

On Linux, a restricted-read custom permission profile can silently allow a write to /codex-write-probe, for which no write access was granted.

The process can immediately read the written data back and exits successfully. However, the file does not exist on the host after the sandbox terminates.

No warning or error is reported. This can make commands believe they have successfully persisted configuration, state, or output when the data will actually be discarded.

What steps can reproduce the bug?

Run this Bash script:

#!/usr/bin/env bash
set -eu

readonly probe_file='/codex-write-probe'

# Required to launch the Linux sandbox itself; a workaround for #24341.
readonly sandbox_runtime_config='permissions.write_probe.filesystem={"~/.codex/tmp/arg0"="read","~/.config/nvm/versions/node"="read"}'

# Filesystem rule under test.
readonly probe_config='permissions.write_probe.filesystem.:minimal="read"'

if [[ -e "$probe_file" ]]; then
    printf 'Probe path already exists; aborting to avoid touching existing data: %s\n' "$probe_file" >&2
    exit 1
fi

if ! codex sandbox \
    -c "$sandbox_runtime_config" \
    -c "$probe_config" \
    -P write_probe \
    -- /bin/bash -c 'echo write ok > "$1" && printf "inside: " && cat "$1"' \
    probe "$probe_file"
then
    printf 'Codex sandbox failed to run.\n' >&2
    exit 1
fi

if [[ -e "$probe_file" ]]; then
    printf 'outside: FILE EXISTS (sandbox wrote to the host)\n' >&2
    exit 2
fi

printf 'outside: absent (write was confined to sandbox tmpfs)\n'

Observed output:

inside: write ok
outside: absent (write was confined to sandbox tmpfs)

What is the expected behavior?

Because the profile grants no write access to /codex-write-probe, the attempted write should fail with a permission-related error such as EACCES or EROFS, rather than silently succeed against ephemeral storage.

Additional information

The read-only entries in sandbox_runtime_config are an installation-specific bootstrap workaround for #24341. They are required to launch codex-linux-sandbox in this environment and are not part of the filesystem behavior under test.

For a restricted-read permission profile, create_filesystem_args() starts the sandbox filesystem with a writable tmpfs as / and adds each permitted readable root with --ro-bind, but does not make the backing tmpfs read-only:

--tmpfs /

The write to /codex-write-probe therefore succeeds directly against the backing tmpfs even though the permission profile contains no matching write rule.

This was confirmed from inside the reproduced sandbox:

TARGET SOURCE FSTYPE OPTIONS
/      tmpfs  tmpfs  rw,nosuid,nodev,relatime,mode=755,uid=1000,gid=1000,inode64