Skip to content

codex engine: unprivileged-user safety strategy (drop-sudo kills the runner) #40

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ransomr merged 4 commits into from
Sep 1, 2026
Merged

codex engine: unprivileged-user safety strategy (drop-sudo kills the runner) #40

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
68c6fd6
codex engine: unprivileged-user safety strategy (drop-sudo kills the …
ransomr Aug 31, 2026
8990b93
review round 1: RUNNER_TEMP write + safe.directory for the codex user
i-am-marvin Aug 31, 2026
a55fe12
review round 2: RUNNER_TEMP subdir, land-step .git reclaim, reviewer …
i-am-marvin Aug 31, 2026
f087913
review round 3: output-schema-file workaround, codexuser step id + su…
i-am-marvin Sep 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions .github/workflows/claude-auto-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -535,12 +535,35 @@ jobs:
.pytest_cache/ .mypy_cache/ .ruff_cache/ .coverage node_modules/ \
>>.git/info/exclude

# codex-action's default safety-strategy (drop-sudo) chmods root-owned
# service sockets under /run, breaking D-Bus -> systemd-resolved -> DNS;
# the hosted runner then dies with "lost communication" 52-65 minutes
# into the job (openai/codex-action#160; observed twice at ~62 min on
# inspect_ai#389, 2026-08-31). Until fixed upstream, run codex as a
# dedicated unprivileged user — the README's other blessed strategy for
# permission profiles: containment is the user boundary plus the
# profile sandbox, and the API key stays out of reach (codex has no
# sudo). Setup mirrors the action's examples/unprivileged-user.yml;
# the group plumbing lets the runner user land codex's edits afterward.
- name: Create codex user
if: steps.gate.outputs.act == 'fix' && steps.gate.outputs.engine == 'codex'
run: |
set -euo pipefail
sudo adduser --system --home /home/codex --shell /bin/bash --group codex
sudo usermod -a -G codex runner
sudo usermod -a -G runner codex
sudo chown -R runner:codex "$GITHUB_WORKSPACE"
sudo chmod -R g+rwX "$GITHUB_WORKSPACE"
sudo find "$GITHUB_WORKSPACE" -type d -exec chmod g+s {} +

- name: Run Codex fix
id: codexfix
if: steps.gate.outputs.act == 'fix' && steps.gate.outputs.engine == 'codex'
uses: openai/codex-action@v1
with:
openai-api-key: ${{ secrets.OPENAI_API_KEY }}
safety-strategy: unprivileged-user
codex-user: codex
model: ${{ inputs.codex_model }}
permission-profile: ":workspace"
allow-bot-users: "claude"
Expand Down
23 changes: 23 additions & 0 deletions .github/workflows/claude-auto.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -357,12 +357,35 @@ jobs:
.pytest_cache/ .mypy_cache/ .ruff_cache/ .coverage node_modules/ \
>>.git/info/exclude

# codex-action's default safety-strategy (drop-sudo) chmods root-owned
# service sockets under /run, breaking D-Bus -> systemd-resolved -> DNS;
# the hosted runner then dies with "lost communication" 52-65 minutes
# into the job (openai/codex-action#160; observed twice at ~62 min on
# inspect_ai#389, 2026-08-31). Until fixed upstream, run codex as a
# dedicated unprivileged user — the README's other blessed strategy for
# permission profiles: containment is the user boundary plus the
# profile sandbox, and the API key stays out of reach (codex has no
# sudo). Setup mirrors the action's examples/unprivileged-user.yml;
# the group plumbing lets the runner user land codex's edits afterward.
- name: Create codex user
if: steps.gate.outputs.act == 'fix' && steps.gate.outputs.engine == 'codex'
run: |
set -euo pipefail
sudo adduser --system --home /home/codex --shell /bin/bash --group codex
sudo usermod -a -G codex runner
sudo usermod -a -G runner codex
sudo chown -R runner:codex "$GITHUB_WORKSPACE"
sudo chmod -R g+rwX "$GITHUB_WORKSPACE"
sudo find "$GITHUB_WORKSPACE" -type d -exec chmod g+s {} +

- name: Run Codex CI fix
id: codexfix
if: steps.gate.outputs.act == 'fix' && steps.gate.outputs.engine == 'codex'
uses: openai/codex-action@v1
with:
openai-api-key: ${{ secrets.OPENAI_API_KEY }}
safety-strategy: unprivileged-user
codex-user: codex
model: ${{ inputs.codex_model }}
permission-profile: ":workspace"
# workflow_run's actor is the CI run's actor: normally the machine
Expand Down
23 changes: 23 additions & 0 deletions .github/workflows/claude-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -622,12 +622,35 @@ jobs:
# Our trig gate did the real authorization; allow-bot-users lifts the
# action's own actor guard for the reviewer-bot trigger the Claude
# path already accepts (the dev agent's @review hand-back).
# codex-action's default safety-strategy (drop-sudo) chmods root-owned
Comment thread
ransomr marked this conversation as resolved.
# service sockets under /run, breaking D-Bus -> systemd-resolved -> DNS;
# the hosted runner then dies with "lost communication" 52-65 minutes
# into the job (openai/codex-action#160; observed twice at ~62 min on
# inspect_ai#389, 2026-08-31). Until fixed upstream, run codex as a
# dedicated unprivileged user — the README's other blessed strategy for
# permission profiles: containment is the user boundary plus the
# profile sandbox, and the API key stays out of reach (codex has no
# sudo). Setup mirrors the action's examples/unprivileged-user.yml;
# the group plumbing lets the runner user land codex's edits afterward.
- name: Create codex user
Comment thread
ransomr marked this conversation as resolved.
if: steps.trig.outputs.ok == 'true' && steps.engine.outputs.engine == 'codex'
run: |
set -euo pipefail
sudo adduser --system --home /home/codex --shell /bin/bash --group codex
sudo usermod -a -G codex runner
sudo usermod -a -G runner codex
sudo chown -R runner:codex "$GITHUB_WORKSPACE"
Comment thread
ransomr marked this conversation as resolved.
Outdated
Comment thread
ransomr marked this conversation as resolved.
Outdated
sudo chmod -R g+rwX "$GITHUB_WORKSPACE"
sudo find "$GITHUB_WORKSPACE" -type d -exec chmod g+s {} +

- name: Run Codex review
id: codex
if: steps.trig.outputs.ok == 'true' && steps.engine.outputs.engine == 'codex'
uses: openai/codex-action@v1
with:
openai-api-key: ${{ secrets.OPENAI_API_KEY }}
safety-strategy: unprivileged-user
Comment thread
ransomr marked this conversation as resolved.
codex-user: codex
model: ${{ inputs.codex_model }}
effort: ${{ inputs.codex_effort }}
permission-profile: ":read-only"
Expand Down
23 changes: 23 additions & 0 deletions .github/workflows/claude.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -588,12 +588,35 @@ jobs:
.pytest_cache/ .mypy_cache/ .ruff_cache/ .coverage node_modules/ \
>>.git/info/exclude

# codex-action's default safety-strategy (drop-sudo) chmods root-owned
# service sockets under /run, breaking D-Bus -> systemd-resolved -> DNS;
# the hosted runner then dies with "lost communication" 52-65 minutes
# into the job (openai/codex-action#160; observed twice at ~62 min on
# inspect_ai#389, 2026-08-31). Until fixed upstream, run codex as a
# dedicated unprivileged user — the README's other blessed strategy for
# permission profiles: containment is the user boundary plus the
# profile sandbox, and the API key stays out of reach (codex has no
# sudo). Setup mirrors the action's examples/unprivileged-user.yml;
# the group plumbing lets the runner user land codex's edits afterward.
Comment thread
ransomr marked this conversation as resolved.
Outdated
- name: Create codex user
if: steps.engine.outputs.engine == 'codex'
run: |
set -euo pipefail
sudo adduser --system --home /home/codex --shell /bin/bash --group codex
sudo usermod -a -G codex runner
sudo usermod -a -G runner codex
sudo chown -R runner:codex "$GITHUB_WORKSPACE"
sudo chmod -R g+rwX "$GITHUB_WORKSPACE"
sudo find "$GITHUB_WORKSPACE" -type d -exec chmod g+s {} +

- name: Run Codex
id: codexrun
if: steps.engine.outputs.engine == 'codex'
uses: openai/codex-action@v1
with:
openai-api-key: ${{ secrets.OPENAI_API_KEY }}
safety-strategy: unprivileged-user
codex-user: codex
model: ${{ inputs.codex_model }}
permission-profile: ":workspace"
# Authorization: codex-action's own built-in write-access check on
Expand Down
12 changes: 12 additions & 0 deletions design/codex-engine.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,6 +113,18 @@ the secret: codex-labeled runs fail at the codex step with a clear
error rather than silently falling back (a silent Claude fallback would
misattribute output).

## Safety strategy: unprivileged-user, not drop-sudo

codex-action's default `drop-sudo` chmods root-owned service sockets under
`/run`, which breaks D-Bus, crashes systemd-resolved, and kills DNS — the
hosted runner then dies with "lost communication" 52–65 minutes into the
job (openai/codex-action#160; hit twice at ~62 min on the first codex
runs, inspect_ai#389). Every codex step therefore creates a dedicated
`codex` system user and runs with `safety-strategy: unprivileged-user`:
containment is the user boundary plus the permission-profile sandbox, the
API key stays unreadable (codex has no sudo), and the host is never
mutated. Revisit when #160's fixes land upstream.

## v1 limitations (deliberate)

- **External proxy reviews stay on Claude** — their contributor-code
Expand Down
Loading