Landlock: fallback to supported ABI or exit with error
What version of Codex is running?
codex-cli 0.58.0
What subscription do you have?
API
Which model were you using?
gpt-5.1-codex
What platform is your computer?
Linux 6.1.0-41-amd64 x86_64 unknown
What issue are you seeing?
ABI::V5 is hardcoded under: https://github.com/openai/codex/blob/main/codex-rs/linux-sandbox/src/landlock.rs#L60
This effectively disables sandboxing for any Linux distribution with a kernel version below 6.12, like Debian 12 or Ubuntu 24.04, which are still supported and widely deployed. In my case, codex is able to freely access the filesystem, only restrained by the current user's permissions. I think this is inherently an insecure design since there was no warning whatsoever which informed me about this.
What steps can reproduce the bug?
Use a kernel below 6.12 and run codex sandbox linux ls .. as a minimal PoC.
Or simply ask codex in a normal session to read a file outside of the current directory, with default security settings.
What is the expected behavior?
If any enabled sandboxing feature is not working, codex should exit with an error after startup. Only if the user passes the argument --yolo or adjusts the sandbox in a way that would make it compatible, should codex run. There should be a --best-effort mode, similar to how landrun allows for it.
Additional information
_No response_
2 Comments
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
Powered by Codex Action
Not a duplicate.
I think this is like https://github.com/openai/codex/security/advisories/GHSA-w5fx-fh39-j5rw but only for a subset of Linux users. I didn't submit it as a vulnerability though because someone else published a similar behavior via https://github.com/openai/codex/issues/5237 A MONTH AGO, but on MacOS:
I was also surprised by this after using codex for a while. Thankfully I didn't enable web search because otherwise someone might have done prompt injection and took control of my Linux machine. Why isn't OpenAI prioritising this vulnerability? At least warn the user if the sandboxing is not expected to work.