Android/Termux: sandbox reads /proc/sys/kernel/overflowuid before bwrap, fails with Permission denied

Environment

• Codex CLI: 0.146.0 (standalone)
• Platform: Android 14 (aarch64), kernel 6.1.115
• Shell: Termux 0.119.0
• No proot, native Termux environment

Problem

Codex sandbox initialization fails on native Termux (no proot) because it reads /proc/sys/kernel/overflowuid before invoking bwrap. Android SELinux blocks this read, so the sandbox never initializes, regardless of whether bwrap is installed or not.

bwrap: Can't read /proc/sys/kernel/overflowuid: Permission denied

This error occurs on every shell execution. Codex then falls back to running commands outside the sandbox entirely.

Steps to Reproduce

1. Install Codex CLI on native Termux (Android)
2. Run any command that triggers the sandbox
3. Observe bwrap: Can't read /proc/sys/kernel/overflowuid: Permission denied

Why This Happens

/proc/sys/kernel/overflowuid is a Linux kernel sysctl. On Android, SELinux restricts access to many sysctl files under /proc/sys/. This is by design and cannot be changed without root.

Suggestion

Codex should detect Android/Termux environments and gracefully degrade:

• Detect via /proc/version containing android or presence of /system/build.prop
• Skip the overflowuid check (or use the POSIX constant 65534 as fallback)
• Optionally warn the user that sandbox is disabled, rather than failing silently

Related

• #11809 (native Termux auth/lock failures)
• #30153 (bwrap fchdir error in proot Debian)
• #36398 (apply_patch not working in rootless nethunter)