[codex] Scope Windows sandbox write-root capability SIDs#21479
[codex] Scope Windows sandbox write-root capability SIDs#21479adrianbravo-oai wants to merge 2 commits intomainfrom
Conversation
|
Codex Review: Didn't find any major issues. Keep it up! ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c94598d733
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| let Some(root_sid) = matching_root_capability(p, write_root_sids) else { | ||
| continue; | ||
| }; |
There was a problem hiding this comment.
Handle the read-only path explicitly instead of skipping it. apply_legacy_session_acl_rules now selects SIDs only via matching_root_capability; for SandboxPolicy::ReadOnly, write_root_sids is empty, so every allow path is skipped. That drops capability allow ACE application for legacy read-only sessions, which can block expected file reads under restricted tokens.
Useful? React with 👍 / 👎.
|
Codex Review: Didn't find any major issues. Delightful! ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
Summary
Testing