codex exec -s read-only allows filesystem writes when nested under external sandbox

codex exec -s read-only allows filesystem writes when Codex is run inside another Codex-managed sandbox

Summary

When I run codex exec -s read-only from inside an existing Codex session, the nested Codex process reports sandbox: read-only, blocks network, but still allows filesystem writes via the shell tool.

This does not match the behavior of codex sandbox linux --enable use_legacy_landlock, which correctly denies the same write with Permission denied.

Environment

• Codex CLI: codex-cli 0.116.0
• bubblewrap: bubblewrap 0.6.1
• OS: Pop!_OS 22.04 LTS
• Config includes:

[sandbox_workspace_write]
network_access = true

[features]
use_legacy_landlock = true

• Nested process environment includes:

CODEX_CI=1
CODEX_MANAGED_BY_NPM=1
CODEX_SANDBOX_NETWORK_DISABLED=1
CODEX_THREAD_ID=...

Minimal repro

This repro is specifically for running Codex from inside another Codex session or Codex-managed environment.

1. Control check: direct Linux sandbox denies write

codex sandbox linux --enable use_legacy_landlock /bin/bash -lc   "printf helper_landlock > /home/cryptotrading74/helper_landlock_probe_2.txt"

Observed output:

/bin/bash: line 1: /home/cryptotrading74/helper_landlock_probe_2.txt: Permission denied

The file is not created.

2. Nested codex exec -s read-only still writes to the workdir

codex exec --ephemeral --skip-git-repo-check --color never --json   -s read-only -C /home/cryptotrading74   "Use the shell tool to run exactly: printf read_only_probe > /home/cryptotrading74/ro_probe_json.txt . Then stop."   > /tmp/codex_ro_jsonl.txt

Observed JSON transcript excerpt:

{"type":"item.started","item":{"type":"command_execution","command":"/bin/bash -lc 'printf read_only_probe > /home/cryptotrading74/ro_probe_json.txt'","status":"in_progress"}}
{"type":"item.completed","item":{"type":"command_execution","command":"/bin/bash -lc 'printf read_only_probe > /home/cryptotrading74/ro_probe_json.txt'","exit_code":0,"status":"completed"}}

The file is created successfully with contents:

read_only_probe

3. Network is still blocked in the same nested read-only session

codex exec --ephemeral --skip-git-repo-check --color never --json   -s read-only -C /home/cryptotrading74   "Run curl -I https://example.com and stop."   > /tmp/codex_ro_network_jsonl.txt

Observed transcript excerpt:

{"type":"item.completed","item":{"type":"command_execution","command":"/bin/bash -lc 'curl -I https://example.com'","exit_code":6,"status":"failed"}}

Observed command output:

curl: (6) Could not resolve host: example.com

Expected behavior

If codex exec reports sandbox: read-only, shell tool commands should not be able to create or modify files in the workdir.

Actual behavior

In this nested environment, codex exec -s read-only appears to enforce the network restriction but not the filesystem restriction.

Notes

• The same write is denied by codex sandbox linux --enable use_legacy_landlock, so the Linux sandbox backend itself can enforce the restriction.
• The behavior is the same with --disable unified_exec.
• The behavior is also the same with --disable use_legacy_landlock, which suggests this is not specific to the legacy Landlock backend.
• My working hypothesis is that nested codex exec is entering an external sandbox mode that honors network state but effectively treats disk access as unrestricted.

Files / artifacts

• /tmp/codex_ro_jsonl.txt
• /tmp/codex_ro_network_jsonl.txt
• /home/cryptotrading74/ro_probe_json.txt
• /home/cryptotrading74/ro_probe_plain.txt

Suggested title

codex exec -s read-only allows filesystem writes when nested under external sandbox