workspace-write sandbox: creating POSIX semaphores fails with `PermissionError: [Errno 13] Permission denied`

What version of Codex is running?

codex-cli 0.63.0

What subscription do you have?

Pro/Business

Which model were you using?

gpt-5.1-codex-max

What platform is your computer?

Linux 5.15.167.4-microsoft-standard-WSL2 x86_64 on Windows 11

What issue are you seeing?

In workspace-write sandbox, creating POSIX semaphores fails with PermissionError: [Errno 13] Permission denied when Python’s multiprocessing spawns a ProcessPoolExecutor. This breaks unit tests that otherwise pass locally and in danger-full-access. There is no config knob to allow semaphores; behavior is unexpected for code that only writes inside the workspace.

What steps can reproduce the bug?

Minimal repro sketch

from concurrent.futures import ProcessPoolExecutor

def f(x): return x + 1

if __name__ == "__main__":
    with ProcessPoolExecutor() as ex:
        print(list(ex.map(f, [1, 2, 3])))

Run inside Codex workspace-write (any project) → PermissionError: [Errno 13] Permission denied from _multiprocessing.SemLock.

What is the expected behavior?

ProcessPoolExecutor should work in workspace-write when child processes only touch workspace paths and /tmp (already allowed), or the sandbox should provide a documented switch to allow POSIX semaphores.

Additional information

Suggestions to fix and/or document:

• Provide a config flag (e.g., sandbox_workspace_write.allow_posix_ipc=true) to enable _multiprocessing.SemLock//dev/shm usage for subprocess pools.
• Clarify in docs if IPC is intentionally blocked; current behavior is surprising and breaks standard library multiprocessing.