codex gets stuck at sudo step running on Ubuntu

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #5349

Powered by Codex Action

I also observed this issue. Very annoying!
I also don't understand why it should get sudo permissions at all.
If I manually run sudo before, programs will not ask for sudo password for some time. I though this could be a workaround.
But then I see this:

  └ sudo: The "no new privileges" flag is set, which prevents sudo from running as root.
    sudo: If sudo is running in a container, you may need to adjust the container configuration to disable the flag.

Seems like it's running in some container as root?

just ran into this in ubuntu, really annoying

Hey! I ran into a similar pattern in our bug knowledge base and thought this might help.

What's happening: Codex sandbox sets PR_SET_NO_NEW_PRIVS (prctl/seccomp) which kernel-blocks sudo privilege escalation. Additionally, Codex PTY layer does not properly relay interactive stdin to sudo password prompt, causing frozen terminal.

What worked for us:

Pre-scan commands for sudo/pkexec before execution. If detected: (1) reject with clear error explaining sandbox limitation, (2) suggest user run sudo -v in a separate terminal to cache credentials (won't work due to no_new_privs), or (3) recommend user pre-install dependencies outside Codex. For the frozen terminal: add a timeout on interactive stdin prompts and detect sudo password prompt pattern to abort early with actionable message.

// In command executor, before spawning process:
const PRIVILEGE_ESCALATION = /\b(sudo|pkexec|doas|su\s)\b/;
if (PRIVILEGE_ESCALATION.test(command)) {
  return {
    error: 'SANDBOX_NO_SUDO',
    message: 'Commands requiring sudo cannot run inside Codex sandbox (no_new_privs is set). Run this command manually in your terminal, then retry without sudo.'
  };
}

// In PTY output handler, detect stuck sudo prompt:
const SUDO_PROMPT = /\[sudo\] password|Password for/;
if (SUDO_PROMPT.test(output)) {
  process.kill(childPid, 'SIGTERM');
  return { error: 'SUDO_PROMPT_DETECTED', message: 'sudo password prompt detected — aborting. Run privileged commands outside Codex.' };
}

Hope this helps! Let me know if it doesn't match your case — happy to dig deeper. 🦞

_Disclosure: This analysis is from Confucius Debug, an AI-powered community KB for agent bugs. Please verify before applying._

---
_{🦞 Confucius Debug — community knowledge base for AI agent bugs. Free to search via MCP.}

It's happening to me. Whenever I want codex run some "sudo" command, it doesn't allow me to type the password, so it's always stuck on some tasks, like debugging driver problems.

A workaround for linux users:

Run sudo visudo to edit the sudoers file
Add a line for your user:
your_username_here ALL=(ALL) NOPASSWD: ALL

Note: This has significant security implications and should ideally be restricted to specific commands like
NOPASSWD: /usr/bin/apt-get)