Sandbox blocks NAG/Kusari MAC-based license validation

What version of Codex CLI is running?

codex-cli 0.106.0

What subscription do you have?

plus

Which model were you using?

gpt-5.3-codex

What platform is your computer?

Linux 6.17.10-100.fc41.x86_64 x86_64 unknown

What terminal emulator and version are you using (if applicable)?

MATE Terminal

What issue are you seeing?

## Summary

ml nag && nagfor -xlicinfo fails inside Codex with Error: Invalid licence,
but succeeds on the host with the same license file and same licensed
interface.

This looks like a Codex sandbox/runtime issue, not a NAG license-file issue.

What steps can reproduce the bug?

## Repro

```bash
ml nag && nagfor -xlicinfo

## Expected

NAG Fortran Compiler Release 7.2(Shin-Urayasu) Build 7236
FULL licence (licence from file)
Kusari version is 2.2(101)

## Actual

NAG Fortran Compiler Release 7.2(Shin-Urayasu) Build 7236
Error: Invalid licence
Kusari version is 2.2(101)

## Environment

• Codex installed via npm
• NAG module: nag/7.2
• NAG_KUSARI_FILE=/opt/nag/nagfor-7.2/lib/nag.licence
• Licensed interface: eth-nag
• Licensed MAC: b4:2e:99:3a:2f:9c

## Diagnostics

Inside Codex:

• /sys/class/net/eth-nag/address is readable and shows the expected MAC
• socket.if_nametoindex("eth-nag") works
• socket(AF_INET, SOCK_DGRAM) fails with EPERM
• socket(AF_NETLINK, SOCK_RAW, 0) fails with EPERM

Outside the sandbox:

• socket(AF_INET, SOCK_DGRAM) works
• ioctl(SIOCGIFHWADDR) on eth-nag works
• socket(AF_NETLINK, SOCK_RAW, 0) works
• nagfor -xlicinfo succeeds

## Request

Please confirm whether this sandbox restriction is expected, and whether there
is a supported way to allow the socket calls needed for MAC-based license
validation tools like NAG/Kusari.

What is the expected behavior?

_No response_

Additional information

_No response_