mirror of
https://github.com/pchuan98/codex.git
synced 2026-07-01 00:31:56 +08:00
Michael Bolin
411bfeb410
This introduces a standalone executable that run the equivalent of the `codex debug landlock` subcommand and updates `rust-release.yml` to include it in the release. The idea is that we will include this small binary with the TypeScript CLI to provide support for Linux sandboxing.
38 lines
1.3 KiB
Rust
38 lines
1.3 KiB
Rust
//! `debug landlock` implementation for the Codex CLI.
|
|
//!
|
|
//! On Linux the command is executed inside a Landlock + seccomp sandbox by
|
|
//! calling the low-level `exec_linux` helper from `codex_core::linux`.
|
|
|
|
use codex_core::protocol::SandboxPolicy;
|
|
use std::os::unix::process::ExitStatusExt;
|
|
use std::process;
|
|
use std::process::Command;
|
|
use std::process::ExitStatus;
|
|
|
|
/// Execute `command` in a Linux sandbox (Landlock + seccomp) the way Codex
|
|
/// would.
|
|
pub fn run_landlock(command: Vec<String>, sandbox_policy: SandboxPolicy) -> anyhow::Result<()> {
|
|
if command.is_empty() {
|
|
anyhow::bail!("command args are empty");
|
|
}
|
|
|
|
// Spawn a new thread and apply the sandbox policies there.
|
|
let handle = std::thread::spawn(move || -> anyhow::Result<ExitStatus> {
|
|
codex_core::linux::apply_sandbox_policy_to_current_thread(sandbox_policy)?;
|
|
let status = Command::new(&command[0]).args(&command[1..]).status()?;
|
|
Ok(status)
|
|
});
|
|
let status = handle
|
|
.join()
|
|
.map_err(|e| anyhow::anyhow!("Failed to join thread: {e:?}"))??;
|
|
|
|
// Use ExitStatus to derive the exit code.
|
|
if let Some(code) = status.code() {
|
|
process::exit(code);
|
|
} else if let Some(signal) = status.signal() {
|
|
process::exit(128 + signal);
|
|
} else {
|
|
process::exit(1);
|
|
}
|
|
}
|