Linux bubblewrap bootstrap fails for custom permission rules targeting regular or missing paths

What version of Codex CLI is running?

codex-cli 0.149.1

What platform are you using?

Linux x86_64 on a shared multi-user host.

What issue are you seeing?

Custom filesystem permission profiles can cause the Linux bubblewrap sandbox to
fail during app-server/TUI bootstrap, before AGENTS.md instructions load or a
model request begins.

Three related path shapes produced distinct failures:

1. A writable rule targeting a regular file caused Codex to synthesize child

mount paths beneath that file:

``text
bwrap: Can't mkdir parents for /home/user/.codex/config.toml/.git:
Not a directory
``

The sandbox helper then panicked while inspecting:

``text
/home/user/.codex/config.toml/.codex
``

1. A writable workspace-relative path that did not exist caused a bind-mount

failure:

``text
bwrap: Can't bind mount /bindfile... on
/newroot/workspace/project/.agents:
No such file or directory
``

1. An exact deny rule beneath a missing optional directory caused bubblewrap to

attempt to create the masking target beneath a read-only parent:

``text
bwrap: Can't create file at
/workspace/another-project/.agents/.env:
Read-only file system
``

These failures also affect:

codex --strict-config doctor --json

because it exercises app-server/session bootstrap.

What steps can reproduce the bug?

Use a custom permission profile and test the following variants separately.

Variant A: regular file used as a writable root

default_permissions = "repro"

[permissions.repro]

[permissions.repro.filesystem]
":minimal" = "read"
"~/.codex/config.toml" = "write"

[permissions.repro.filesystem.":workspace_roots"]
"." = "write"

Start Codex or run:

codex --strict-config doctor --json

Variant B: missing optional writable path

In a workspace without a .agents directory:

default_permissions = "repro"

[permissions.repro]

[permissions.repro.filesystem]
":minimal" = "read"

[permissions.repro.filesystem.":workspace_roots"]
"." = "write"
".agents" = "write"

Start Codex.

Variant C: exact deny path beneath a missing directory

In a workspace without .agents:

default_permissions = "repro"

[permissions.repro]

[permissions.repro.filesystem]
":minimal" = "read"

[permissions.repro.filesystem.":workspace_roots"]
"." = "write"
".agents/.env" = "deny"

Start Codex, including through an app-server session containing multiple
workspace roots.

What is the expected behavior?

• A regular-file permission should be represented as a file mount rather than

treated as a directory root.

• Missing optional paths should be protected or made writable entirely inside

the mount namespace without requiring host-side targets to exist.

• A deny rule beneath a missing parent should not abort sandbox creation.
• If a permission shape cannot be represented safely, Codex should return a

clear configuration diagnostic rather than panic or fail session bootstrap.

Workaround

Using Codex's built-in :workspace permission profile avoids the failing custom
filesystem-rule expansion.

Related issues

• #39944 — denying

slash_tmp breaks Linux synthetic-mount bootstrap.

• #37318 — a missing .git

target causes bubblewrap setup failure.

• #23601 — read-only failure

while creating .codex/tmp.

• #16088 — missing protected

paths are materialized during sandbox setup.

• #17079 — protected carveout

mount failure for symlink layouts.

• #33479 and

#37632 — related but distinct
recursive expansion of relative :workspace_roots rules.