Whitelisted commands lose sandbox bypass in compound commands
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 76/100
- Issue type
- Documentation
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- rust
- Domain
- documentation
Research direction
Read the command-segmentation guidance in codex-rs/prompts/templates/permissions/approval_policy/on_request.md and codex-rs/prompts/templates/permissions/approval_policy/on_request_rule_request_permission.md. Add the proposed clarification after that guidance in both files, then verify that each explains sandbox bypass requires an explicit allow match for every shell segment and recommends running whitelisted commands standalone.
Written by the indexing model from the issue text.
Description
Problem
With ["gh", "auth", "status"] in Approved command prefixes, standalone gh auth status bypasses the sandbox. The github:yeet workflow may nevertheless batch it with repository checks before publishing:
git status -sb && git diff && gh auth status
The standalone gh auth status allow rule does not bypass the sandbox because the preceding git segments have no explicit allow rule. The whole invocation stays sandboxed, so gh may be unable to access the host keyring and incorrectly report an invalid token.
Root cause
codex-rs/core/src/exec_policy.rs only bypasses the sandbox when every parsed shell segment has an explicit allow match. The model-facing instructions say segments are evaluated independently, but omit that condition.
Proposed clarification
Add this after the command-segmentation guidance in:
codex-rs/prompts/templates/permissions/approval_policy/on_request.mdcodex-rs/prompts/templates/permissions/approval_policy/on_request_rule_request_permission.md
Exec-policy allows sandbox bypass only when every shell segment has an explicit allow match. Run whitelisted commands standalone.
This preserves the security model while preventing an avoidable failure in a common GitHub publishing workflow.
- Dominant language
- Rust
- Stars
- 125k
- Forks
- 19.5k
- Avg merge
- 1m
- Merged PRs (30d)
- 1k
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from openai/codex
-
enhancement remote
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
bug CLI windows-os
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
macOS sandbox blocks hw.optional.arm64 sysctl, causing Flutter to misdetect Apple Silicon as x64 Openbug CLI sandbox
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
bug CLI TUI
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
-
CLI config enhancement skills
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
kwakseongjae/auto-hwp#319 ·
-
area:cli bug filter-quality good first issue priority:medium
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Difficulty 1/5 Under an hour Newbie friendliness 72/100
bevyengine/bevy#25861 ·
-
comp-datalake
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
ClickHouse/ClickHouse#121222 ·
-
A-linter
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
oxc-project/oxc#26863 ·