221ebfcccc
Building on the work of https://github.com/openai/codex/pull/1702, this changes how a shell call to `apply_patch` is handled. Previously, a shell call to `apply_patch` was always handled in-process, never leveraging a sandbox. To determine whether the `apply_patch` operation could be auto-approved, the `is_write_patch_constrained_to_writable_paths()` function would check if all the paths listed in the paths were writable. If so, the agent would apply the changes listed in the patch. Unfortunately, this approach afforded a loophole: symlinks! * For a soft link, we could fix this issue by tracing the link and checking whether the target is in the set of writable paths, however... * ...For a hard link, things are not as simple. We can run `stat FILE` to see if the number of links is greater than 1, but then we would have to do something potentially expensive like `find . -inum <inode_number>` to find the other paths for `FILE`. Further, even if this worked, this approach runs the risk of a [TOCTOU](https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use) race condition, so it is not robust. The solution, implemented in this PR, is to take the virtual execution of the `apply_patch` CLI into an _actual_ execution using `codex --codex-run-as-apply-patch PATCH`, which we can run under the sandbox the user specified, just like any other `shell` call. This, of course, assumes that the sandbox prevents writing through symlinks as a mechanism to write to folders that are not in the writable set configured by the sandbox. I verified this by testing the following on both Mac and Linux: ```shell #!/usr/bin/env bash set -euo pipefail # Can running a command in SANDBOX_DIR write a file in EXPLOIT_DIR? # Codex is run in SANDBOX_DIR, so writes should be constrianed to this directory. SANDBOX_DIR=$(mktemp -d -p "$HOME" sandboxtesttemp.XXXXXX) # EXPLOIT_DIR is outside of SANDBOX_DIR, so let's see if we can write to it. EXPLOIT_DIR=$(mktemp -d -p "$HOME" sandboxtesttemp.XXXXXX) echo "SANDBOX_DIR: $SANDBOX_DIR" echo "EXPLOIT_DIR: $EXPLOIT_DIR" cleanup() { # Only remove if it looks sane and still exists [[ -n "${SANDBOX_DIR:-}" && -d "$SANDBOX_DIR" ]] && rm -rf -- "$SANDBOX_DIR" [[ -n "${EXPLOIT_DIR:-}" && -d "$EXPLOIT_DIR" ]] && rm -rf -- "$EXPLOIT_DIR" } trap cleanup EXIT echo "I am the original content" > "${EXPLOIT_DIR}/original.txt" # Drop the -s to test hard links. ln -s "${EXPLOIT_DIR}/original.txt" "${SANDBOX_DIR}/link-to-original.txt" cat "${SANDBOX_DIR}/link-to-original.txt" if [[ "$(uname)" == "Linux" ]]; then SANDBOX_SUBCOMMAND=landlock else SANDBOX_SUBCOMMAND=seatbelt fi # Attempt the exploit cd "${SANDBOX_DIR}" codex debug "${SANDBOX_SUBCOMMAND}" bash -lc "echo pwned > ./link-to-original.txt" || true cat "${EXPLOIT_DIR}/original.txt" ``` Admittedly, this change merits a proper integration test, but I think I will have to do that in a follow-up PR.
91 lines
3.4 KiB
Rust
91 lines
3.4 KiB
Rust
use std::future::Future;
|
||
use std::path::Path;
|
||
use std::path::PathBuf;
|
||
|
||
use codex_core::CODEX_APPLY_PATCH_ARG1;
|
||
|
||
/// While we want to deploy the Codex CLI as a single executable for simplicity,
|
||
/// we also want to expose some of its functionality as distinct CLIs, so we use
|
||
/// the "arg0 trick" to determine which CLI to dispatch. This effectively allows
|
||
/// us to simulate deploying multiple executables as a single binary on Mac and
|
||
/// Linux (but not Windows).
|
||
///
|
||
/// When the current executable is invoked through the hard-link or alias named
|
||
/// `codex-linux-sandbox` we *directly* execute
|
||
/// [`codex_linux_sandbox::run_main`] (which never returns). Otherwise we:
|
||
///
|
||
/// 1. Use [`dotenvy::from_path`] and [`dotenvy::dotenv`] to modify the
|
||
/// environment before creating any threads.
|
||
/// 2. Construct a Tokio multi-thread runtime.
|
||
/// 3. Derive the path to the current executable (so children can re-invoke the
|
||
/// sandbox) when running on Linux.
|
||
/// 4. Execute the provided async `main_fn` inside that runtime, forwarding any
|
||
/// error. Note that `main_fn` receives `codex_linux_sandbox_exe:
|
||
/// Option<PathBuf>`, as an argument, which is generally needed as part of
|
||
/// constructing [`codex_core::config::Config`].
|
||
///
|
||
/// This function should be used to wrap any `main()` function in binary crates
|
||
/// in this workspace that depends on these helper CLIs.
|
||
pub fn arg0_dispatch_or_else<F, Fut>(main_fn: F) -> anyhow::Result<()>
|
||
where
|
||
F: FnOnce(Option<PathBuf>) -> Fut,
|
||
Fut: Future<Output = anyhow::Result<()>>,
|
||
{
|
||
// Determine if we were invoked via the special alias.
|
||
let mut args = std::env::args_os();
|
||
let argv0 = args.next().unwrap_or_default();
|
||
let exe_name = Path::new(&argv0)
|
||
.file_name()
|
||
.and_then(|s| s.to_str())
|
||
.unwrap_or("");
|
||
|
||
if exe_name == "codex-linux-sandbox" {
|
||
// Safety: [`run_main`] never returns.
|
||
codex_linux_sandbox::run_main();
|
||
}
|
||
|
||
let argv1 = args.next().unwrap_or_default();
|
||
if argv1 == CODEX_APPLY_PATCH_ARG1 {
|
||
let patch_arg = args.next().and_then(|s| s.to_str().map(|s| s.to_owned()));
|
||
let exit_code = match patch_arg {
|
||
Some(patch_arg) => {
|
||
let mut stdout = std::io::stdout();
|
||
let mut stderr = std::io::stderr();
|
||
match codex_apply_patch::apply_patch(&patch_arg, &mut stdout, &mut stderr) {
|
||
Ok(()) => 0,
|
||
Err(_) => 1,
|
||
}
|
||
}
|
||
None => {
|
||
eprintln!("Error: {CODEX_APPLY_PATCH_ARG1} requires a UTF-8 PATCH argument.");
|
||
1
|
||
}
|
||
};
|
||
std::process::exit(exit_code);
|
||
}
|
||
|
||
// This modifies the environment, which is not thread-safe, so do this
|
||
// before creating any threads/the Tokio runtime.
|
||
load_dotenv();
|
||
|
||
// Regular invocation – create a Tokio runtime and execute the provided
|
||
// async entry-point.
|
||
let runtime = tokio::runtime::Runtime::new()?;
|
||
runtime.block_on(async move {
|
||
let codex_linux_sandbox_exe: Option<PathBuf> = if cfg!(target_os = "linux") {
|
||
std::env::current_exe().ok()
|
||
} else {
|
||
None
|
||
};
|
||
|
||
main_fn(codex_linux_sandbox_exe).await
|
||
})
|
||
}
|
||
|
||
/// Load env vars from ~/.codex/.env and `$(pwd)/.env`.
|
||
fn load_dotenv() {
|
||
if let Ok(codex_home) = codex_core::config::find_codex_home() {
|
||
dotenvy::from_path(codex_home.join(".env")).ok();
|
||
}
|
||
dotenvy::dotenv().ok();
|
||
}
|