Skip to content

Linux sandbox (bubblewrap) uses non-unique temp registry path, breaking multi-user /tmp #21192

@agolovanov

Description

@agolovanov

What version of the IDE extension are you using?

v26.429.30905

What subscription do you have?

Plus

Which IDE are you using?

VS Code

What platform is your computer?

Linux 5.14.0-427.42.1.el9_4.x86_64 x86_64 x86_64

What issue are you seeing?

By default, Codex Linux sandbox creates a bubblewrap folder at:

/tmp/codex-bwrap-synthetic-mount-targets

The relevant line of code is:

std::env::temp_dir().join("codex-bwrap-synthetic-mount-targets")

Because the folder is not user or session-specific, the folder can be already created by another user working with Codex, so trying to create it again results in an error:

failed to open synthetic bubblewrap mount registry lock
/tmp/codex-bwrap-synthetic-mount-targets/lock: Permission denied

What steps can reproduce the bug?

Create a /tmp/codex-bwrap-synthetic-mount-targets folder and make it not accessible by the current user. Try using Codex and observe failures to use the sandbox.

What is the expected behavior?

Codex creates a registry path unique to the user, so that sandboxing always works. The folder should probably use a per-user or per-session path, e.g. include UID or username.

Additional information

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingextensionIssues related to the VS Code extensionsandboxIssues related to permissions or sandboxing

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions