Sandbox blocks NAG/Kusari MAC-based license validation
What version of Codex CLI is running?
codex-cli 0.106.0
What subscription do you have?
plus
Which model were you using?
gpt-5.3-codex
What platform is your computer?
Linux 6.17.10-100.fc41.x86_64 x86_64 unknown
What terminal emulator and version are you using (if applicable)?
MATE Terminal
What issue are you seeing?
## Summary
ml nag && nagfor -xlicinfo fails inside Codex with Error: Invalid licence,
but succeeds on the host with the same license file and same licensed
interface.
This looks like a Codex sandbox/runtime issue, not a NAG license-file issue.
What steps can reproduce the bug?
## Repro
```bash
ml nag && nagfor -xlicinfo
## Expected
NAG Fortran Compiler Release 7.2(Shin-Urayasu) Build 7236
FULL licence (licence from file)
Kusari version is 2.2(101)
## Actual
NAG Fortran Compiler Release 7.2(Shin-Urayasu) Build 7236
Error: Invalid licence
Kusari version is 2.2(101)
## Environment
- Codex installed via npm
- NAG module: nag/7.2
- NAG_KUSARI_FILE=/opt/nag/nagfor-7.2/lib/nag.licence
- Licensed interface: eth-nag
- Licensed MAC: b4:2e:99:3a:2f:9c
## Diagnostics
Inside Codex:
- /sys/class/net/eth-nag/address is readable and shows the expected MAC
- socket.if_nametoindex("eth-nag") works
- socket(AF_INET, SOCK_DGRAM) fails with EPERM
- socket(AF_NETLINK, SOCK_RAW, 0) fails with EPERM
Outside the sandbox:
- socket(AF_INET, SOCK_DGRAM) works
- ioctl(SIOCGIFHWADDR) on eth-nag works
- socket(AF_NETLINK, SOCK_RAW, 0) works
- nagfor -xlicinfo succeeds
## Request
Please confirm whether this sandbox restriction is expected, and whether there
is a supported way to allow the socket calls needed for MAC-based license
validation tools like NAG/Kusari.
What is the expected behavior?
_No response_
Additional information
_No response_
3 Comments
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
Powered by Codex Action
The Codex sandbox prevents access to certain protected resources including the network and writes to files outside of your project directory. If you attempt to use a tool that requires access to these resources within the sandbox, that operation will be blocked. Some tools are better than others at handling such failures.
We generally don't consider this a bug in Codex. Its sandbox is working as intended in these cases. You can read more about the Codex sandbox in this documentation.
If you want to investigate further what resource this tool requires, you may find it useful to clone the codex repo and use codex itself to help you with that investigation.
In some cases, tools vendors and maintainers have made changes to their tools to better handle failures due to sandbox safeguards.
While technically accurate, this was a crap answer. Codex just needs to be informed that the nag compiler needs to be run in escalated mode to allow network access to resolve licensing.