Codex calls sudo and uses residual no-password time to run commands with root privilege

What version of Codex CLI is running?

codex-cli 0.125.0

What subscription do you have?

Plus

Which model were you using?

gpt-5.5

What platform is your computer?

Linux 7.0.1-gentoo x86_64 AMD Ryzen 7 8845H w/ Radeon 780M Graphics

What terminal emulator and version are you using (if applicable)?

alacritty

What issue are you seeing?

Though this is the behavior I want, I wonder is there a more direct approach to temporarily grant sudo privilege to codex? Or is this considered a security bug?

────────────────────────────────────────────────────────────────────────────────────────

• The local tree still has Qt 5 dev-qt/qtnetwork and dev-qt/qtxml available. The clean
  fix is to reinstall those Qt 5 providers as real packages, not keep rebuilding WPS;
  after that Portage can drop the old preserved copies once nothing resolves to them.

✔ You approved codex to run sudo emerge --oneshot dev-qt/qtnetwork:5 dev-qt/qtxml:5 this
  time

• Waited for background terminal

• Ran sudo emerge --oneshot dev-qt/qtnetwork:5 dev-qt/qtxml:5
  └ Calculating dependencies  ... done!
    Dependency resolution took 1.97 s (backtrack: 0/20).
    … +403 lines (ctrl + t to view transcript)
    qtbase-everywhere-src-5.15.18_build/config.tests/x86_simd && MAKEFLAGS= /usr/bin/
    gmake clean && MAKEFLAGS= /usr/bin/gmake

• The install is underway. It is building dev-qt/qtnetwork-5.15.18 first, then dev-qt/
  qtxml-5.15.18; this is a source build, so it may take a few minutes.

• Waited for background terminal

• qtnetwork has moved past configuration and is compiling the library/plugins now. After
  it installs, qtxml should be much smaller.

• Waited for background terminal

• Ran sudo emerge --oneshot dev-qt/qtnetwork:5 dev-qt/qtxml:5
  └ Calculating dependencies  ... done!
    Dependency resolution took 1.97 s (backtrack: 0/20).
    … +2599 lines (ctrl + t to view transcript)

     * GNU info directory index is up-to-date.

• Waited for background terminal

─ Worked for 1m 29s ────────────────────────────────────────────────────────────────────

What steps can reproduce the bug?

➜  ~ sudo echo 1
1
➜  ~ codex
╭────────────────────────────────────────────╮
│ >_ OpenAI Codex (v0.125.0)                 │
│                                            │
│ model:     gpt-5.5 high   /model to change │
│ directory: ~                               │
╰────────────────────────────────────────────╯

  Tip: New Use /fast to enable our fastest inference with increased plan usage.


› Run 'sudo echo 1'


✔ You approved codex to run sudo echo 1 this time

• Ran sudo echo 1
  └ 1

────────────────────────────────────────────────────────────────────────────────────────

• sudo echo 1 printed:

  1

What is the expected behavior?

Either: there is a designed way to grant root privileges to codex

Or: codex shouldn't make use of residual no-password time for sudo

Additional information

_No response_