From e59e7d163dc4596ca6263b19bacb9d0ec61e39b6 Mon Sep 17 00:00:00 2001 From: viyatb-oai Date: Wed, 14 Jan 2026 15:35:53 -0800 Subject: [PATCH] fix: correct linux sandbox uid/gid mapping after unshare (#9234) fixes https://github.com/openai/codex/issues/9233 ## Summary - capture effective uid/gid before unshare for user namespace maps - pass captured ids into uid/gid map writer ## Testing - just fmt - just fix -p codex-linux-sandbox - cargo test -p codex-linux-sandbox --- codex-rs/linux-sandbox/src/mounts.rs | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/codex-rs/linux-sandbox/src/mounts.rs b/codex-rs/linux-sandbox/src/mounts.rs index f84afad8d..8018814cf 100644 --- a/codex-rs/linux-sandbox/src/mounts.rs +++ b/codex-rs/linux-sandbox/src/mounts.rs @@ -25,8 +25,10 @@ pub(crate) fn apply_read_only_mounts(sandbox_policy: &SandboxPolicy, cwd: &Path) if is_running_as_root() { unshare_mount_namespace()?; } else { + let original_euid = unsafe { libc::geteuid() }; + let original_egid = unsafe { libc::getegid() }; unshare_user_and_mount_namespaces()?; - write_user_namespace_maps()?; + write_user_namespace_maps(original_euid, original_egid)?; } make_mounts_private()?; @@ -152,12 +154,10 @@ struct CapUserData { const LINUX_CAPABILITY_VERSION_3: u32 = 0x2008_0522; -/// Map the current uid/gid to root inside the user namespace. -fn write_user_namespace_maps() -> Result<()> { +/// Map the provided uid/gid to root inside the user namespace. +fn write_user_namespace_maps(uid: libc::uid_t, gid: libc::gid_t) -> Result<()> { write_proc_file("/proc/self/setgroups", "deny\n")?; - let uid = unsafe { libc::getuid() }; - let gid = unsafe { libc::getgid() }; write_proc_file("/proc/self/uid_map", format!("0 {uid} 1\n"))?; write_proc_file("/proc/self/gid_map", format!("0 {gid} 1\n"))?; Ok(())