agent/codex
2
0
Fork 0
mirror of https://github.com/pchuan98/codex.git synced 2026-07-01 00:31:56 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(config): use deny for Unix socket permissions (#24970)

Browse Source 
## Why

Unix socket permissions still accepted and displayed `"none"` while file
permissions use the clearer `"deny"` spelling. This keeps network Unix
socket policy vocabulary consistent with filesystem policy vocabulary.

## What changed

- Replace the Unix socket permission variant and serialized spelling
from `none` to `deny` across config, feature configuration, and network
proxy types.
- Update app-server v2 serialization, TUI debug output, focused tests,
and generated schemas to expose `"deny"`.
- Add coverage for denied Unix socket entries in managed requirements
and profile overlay behavior.

## Security

This is a vocabulary change for explicit Unix socket rejection, not a
network access expansion. Denied entries continue to be omitted from the
effective allowlist.

## Validation

- `just fmt`
- `just write-config-schema`
- `just write-app-server-schema`
- `just test -p codex-config -p codex-core -p codex-app-server-protocol
-p codex-tui -E
'test(network_requirements_are_preserved_as_constraints_with_source) |
test(network_permission_containers_project_allowed_and_denied_entries) |
test(network_toml_overlays_unix_socket_permissions_by_path) |
test(permissions_profiles_resolve_extends_parent_first_with_child_overrides)
| test(network_requirements_serializes_canonical_and_legacy_fields) |
test(debug_config_output_formats_unix_socket_permissions)'`\n- Automatic
`bench-smoke` follow-up from `just test`\n- `cargo clippy -p
codex-config -p codex-core -p codex-features -p codex-network-proxy -p
codex-app-server-protocol -p codex-app-server -p codex-tui --all-targets
-- -D warnings`
This commit is contained in:
viyatb-oai
2026-05-28 16:53:26 -07:00
committed by GitHub
Unverified
parent 912d7d4f75
commit bf72be5927
15 changed files with 39 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json
Generated
+1 -1
View File
@@ -11845,7 +11845,7 @@
"NetworkUnixSocketPermission": {
"enum": [
"allow",
"none"
"deny"
],
"type": "string"
},
codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json
Generated
+1 -1
View File
@@ -8374,7 +8374,7 @@
"NetworkUnixSocketPermission": {
"enum": [
"allow",
"none"
"deny"
],
"type": "string"
},
codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json
Generated
+1 -1
View File
@@ -460,7 +460,7 @@
"NetworkUnixSocketPermission": {
"enum": [
"allow",
"none"
"deny"
],
"type": "string"
},
codex-rs/app-server-protocol/schema/typescript/v2/NetworkUnixSocketPermission.ts
Generated
+1 -1
View File
@@ -2,4 +2,4 @@
// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
export type NetworkUnixSocketPermission = "allow" | "none";
export type NetworkUnixSocketPermission = "allow" | "deny";
codex-rs/app-server-protocol/src/protocol/v2/config.rs
+1 -1
View File
@@ -490,7 +490,7 @@ pub enum NetworkDomainPermission {
#[ts(export_to = "v2/")]
pub enum NetworkUnixSocketPermission {
Allow,
None,
Deny,
}
#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
codex-rs/app-server-protocol/src/protocol/v2/tests.rs
+2 -2
View File
@@ -2278,7 +2278,7 @@ fn network_requirements_serializes_canonical_and_legacy_fields() {
),
(
"/tmp/ignored.sock".to_string(),
NetworkUnixSocketPermission::None,
NetworkUnixSocketPermission::Deny,
),
])),
allow_unix_sockets: Some(vec!["/tmp/proxy.sock".to_string()]),
@@ -2302,7 +2302,7 @@ fn network_requirements_serializes_canonical_and_legacy_fields() {
"allowedDomains": ["api.openai.com"],
"deniedDomains": ["blocked.example.com"],
"unixSockets": {
"/tmp/ignored.sock": "none",
"/tmp/ignored.sock": "deny",
"/tmp/proxy.sock": "allow"
},
"allowUnixSockets": ["/tmp/proxy.sock"],
codex-rs/app-server/src/request_processors/config_processor.rs
+1 -1
View File
@@ -611,7 +611,7 @@ fn map_network_unix_socket_permission_to_api(
) -> NetworkUnixSocketPermission {
match permission {
codex_config::NetworkUnixSocketPermissionToml::Allow => NetworkUnixSocketPermission::Allow,
codex_config::NetworkUnixSocketPermissionToml::None => NetworkUnixSocketPermission::None,
codex_config::NetworkUnixSocketPermissionToml::Deny => NetworkUnixSocketPermission::Deny,
}
}
codex-rs/config/src/config_requirements.rs
+14 -7
View File
@@ -245,14 +245,14 @@ impl NetworkUnixSocketPermissionsToml {
#[serde(rename_all = "lowercase")]
pub enum NetworkUnixSocketPermissionToml {
Allow,
None,
Deny,
}
impl std::fmt::Display for NetworkUnixSocketPermissionToml {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
let permission = match self {
Self::Allow => "allow",
Self::None => "none",
Self::Deny => "deny",
};
f.write_str(permission)
}
@@ -2868,6 +2868,7 @@ command = "python3 /enterprise/hooks/pre.py"
[experimental_network.unix_sockets]
"/tmp/example.sock" = "allow"
"/tmp/blocked.sock" = "deny"
"#;
let source = RequirementSource::CloudRequirements;
@@ -2912,10 +2913,16 @@ command = "python3 /enterprise/hooks/pre.py"
assert_eq!(
sourced_network.value.unix_sockets.as_ref(),
Some(&NetworkUnixSocketPermissionsToml {
entries: BTreeMap::from([(
"/tmp/example.sock".to_string(),
NetworkUnixSocketPermissionToml::Allow,
)]),
entries: BTreeMap::from([
(
"/tmp/blocked.sock".to_string(),
NetworkUnixSocketPermissionToml::Deny,
),
(
"/tmp/example.sock".to_string(),
NetworkUnixSocketPermissionToml::Allow,
),
]),
})
);
assert_eq!(sourced_network.value.allow_local_binding, Some(false));
@@ -3053,7 +3060,7 @@ command = "python3 /enterprise/hooks/pre.py"
),
(
"/tmp/ignored.sock".to_string(),
NetworkUnixSocketPermissionToml::None,
NetworkUnixSocketPermissionToml::Deny,
),
]),
};
codex-rs/config/src/permissions_toml.rs
+3 -3
View File
@@ -327,14 +327,14 @@ impl NetworkUnixSocketPermissionsToml {
#[serde(rename_all = "lowercase")]
pub enum NetworkUnixSocketPermissionToml {
Allow,
None,
Deny,
}
impl std::fmt::Display for NetworkUnixSocketPermissionToml {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
let permission = match self {
Self::Allow => "allow",
Self::None => "none",
Self::Deny => "deny",
};
f.write_str(permission)
}
@@ -547,7 +547,7 @@ impl NetworkToml {
NetworkUnixSocketPermissionToml::Allow => {
ProxyNetworkUnixSocketPermission::Allow
}
NetworkUnixSocketPermissionToml::None => ProxyNetworkUnixSocketPermission::None,
NetworkUnixSocketPermissionToml::Deny => ProxyNetworkUnixSocketPermission::Deny,
};
proxy_unix_sockets.entries.insert(path.clone(), permission);
}
codex-rs/core/config.schema.json
+2 -2
View File
@@ -1773,7 +1773,7 @@
"NetworkProxyUnixSocketPermissionToml": {
"enum": [
"allow",
"none"
"deny"
],
"type": "string"
},
@@ -1825,7 +1825,7 @@
"NetworkUnixSocketPermissionToml": {
"enum": [
"allow",
"none"
"deny"
],
"type": "string"
},
codex-rs/core/src/config/permissions.rs
+2 -2
View File
@@ -176,8 +176,8 @@ pub(crate) fn apply_network_proxy_feature_config(
NetworkProxyUnixSocketPermissionToml::Allow => {
NetworkUnixSocketPermissionToml::Allow
}
NetworkProxyUnixSocketPermissionToml::None => {
NetworkUnixSocketPermissionToml::None
NetworkProxyUnixSocketPermissionToml::Deny => {
NetworkUnixSocketPermissionToml::Deny
}
};
(path.clone(), permission)
codex-rs/core/src/config/permissions_tests.rs
+5 -3
View File
@@ -149,7 +149,7 @@ fn network_permission_containers_project_allowed_and_denied_entries() {
),
(
"/tmp/ignored.sock".to_string(),
NetworkUnixSocketPermissionToml::None,
NetworkUnixSocketPermissionToml::Deny,
),
]),
};
@@ -211,7 +211,7 @@ fn network_toml_overlays_unix_socket_permissions_by_path() {
),
(
"/tmp/override.sock".to_string(),
NetworkUnixSocketPermissionToml::None,
NetworkUnixSocketPermissionToml::Deny,
),
]),
}),
@@ -233,7 +233,7 @@ fn network_toml_overlays_unix_socket_permissions_by_path() {
),
(
"/tmp/override.sock".to_string(),
ProxyNetworkUnixSocketPermission::None,
ProxyNetworkUnixSocketPermission::Deny,
),
]),
})
@@ -265,6 +265,7 @@ enabled = true
[base.network.unix_sockets]
"/tmp/base.sock" = "allow"
"/tmp/blocked.sock" = "deny"
[child]
extends = "base"
@@ -319,6 +320,7 @@ allow_local_binding = true
[network.unix_sockets]
"/tmp/base.sock" = "allow"
"/tmp/blocked.sock" = "deny"
"/tmp/child.sock" = "allow"
"#,
)
codex-rs/features/src/feature_configs.rs
+1 -1
View File
@@ -124,5 +124,5 @@ pub enum NetworkProxyDomainPermissionToml {
#[serde(rename_all = "lowercase")]
pub enum NetworkProxyUnixSocketPermissionToml {
Allow,
None,
Deny,
}
codex-rs/network-proxy/src/config.rs
+1 -1
View File
@@ -107,7 +107,7 @@ impl NetworkDomainPermissions {
#[serde(rename_all = "lowercase")]
pub enum NetworkUnixSocketPermission {
Allow,
None,
Deny,
}
#[derive(Debug, Clone, Serialize, Deserialize, Default, PartialEq, Eq)]
codex-rs/tui/src/debug_config.rs
+3 -3
View File
@@ -518,7 +518,7 @@ fn format_network_unix_socket_permission(
) -> &'static str {
match permission {
NetworkUnixSocketPermissionToml::Allow => "allow",
NetworkUnixSocketPermissionToml::None => "none",
NetworkUnixSocketPermissionToml::Deny => "deny",
}
}
@@ -837,7 +837,7 @@ mod tests {
),
(
"/tmp/blocked.sock".to_string(),
NetworkUnixSocketPermissionToml::None,
NetworkUnixSocketPermissionToml::Deny,
),
]),
}),
@@ -854,7 +854,7 @@ mod tests {
let rendered = render_to_text(&render_debug_config_lines(&stack));
assert!(rendered.contains(
"experimental_network: unix_sockets={/tmp/blocked.sock=none, /tmp/codex.sock=allow} (source: cloud requirements)"
"experimental_network: unix_sockets={/tmp/blocked.sock=deny, /tmp/codex.sock=allow} (source: cloud requirements)"
));
}