Regression (Linux sandbox): 0.81.0+ fails with EPERM on mount remount/bind/ro of .git (0.80.0 OK)

What version of Codex is running?

0.84.0

What subscription do you have?

Pro

Which model were you using?

gpt-5.2-codex

What platform is your computer?

Linux 6.8.0-90-generic x86_64 x86_64

What terminal emulator and version are you using (if applicable)?

Gnome terminal

Title

Regression (Linux sandbox): 0.81.0+ fails with EPERM on mount remount/bind/ro of .git (0.80.0 OK)

Body

Summary

After upgrading Codex CLI, Linux sandbox initialization breaks in workspace-write / --full-auto on versions 0.81.0 and 0.84.0. Downgrading to 0.80.0 fixes the issue.

The crash is reported as a Landlock error, but strace shows the real root cause is mount(2) returning EPERM while trying to remount .git read-only.

This looks related to the change introduced in 0.81.0: “Linux sandbox can mount paths read-only to better protect files from writes (#9112)”. ([OpenAI Developers](https://developers.openai.com/codex/changelog/?utm_source=chatgpt.com "Codex changelog"))

Versions

• ✅ 0.80.0 — works

• ❌ 0.81.0 — regression

• ❌ 0.84.0 — regression

Platform

• Ubuntu Linux

• Kernel: 6.8.0-90-generic

• Install method: npm global (npm i -g @openai/codex@...) — not Snap

• No AppArmor DENIED entries observed

• Landlock is enabled and “Up and running”

Steps to reproduce

1. Install Codex @openai/codex@0.81.0 (or 0.84.0)

1. cd into any git repository

1. Run:

codex sandbox linux --full-auto true

(Equivalent to using --full-auto, which maps to --sandbox workspace-write + approvals. ([OpenAI Developers](https://developers.openai.com/codex/cli/reference/?utm_source=chatgpt.com "Command line options")))

Expected behavior

Linux sandbox initializes successfully in workspace-write.

Actual behavior

Codex crashes during sandbox init:

thread 'main' panicked at linux-sandbox/src/linux_run_main.rs:30:9:
error running landlock: Io(Os { code: 1, kind: PermissionDenied, message: "Operation not permitted" })

But strace shows the failure is actually:

mount("/home/oleg/Data/projects/ta/.git", "/home/oleg/Data/projects/ta/.git", NULL,
      MS_RDONLY|MS_REMOUNT|MS_BIND, NULL) = -1 EPERM (Operation not permitted)

Diagnostics

Landlock is enabled:

sudo dmesg | grep -i landlock
landlock: Up and running.

Unprivileged user namespaces work:

unshare -U true
echo $?
0

Crucially: the same “bind then remount read-only” operation works manually inside a user+mount namespace:

cd /home/oleg/Data/projects/ta
unshare -Urm bash --noprofile --norc -c '
  mount --bind .git .git &&
  mount -o remount,bind,ro .git &&
  echo OK
'
OK

So the system is capable of the operation; Codex’s sandbox init appears to be doing it in a way that triggers EPERM (e.g., ordering / namespace / capabilities issue).

Workarounds

• Downgrading to @openai/codex@0.80.0 fixes it.

• sandbox_mode = "danger-full-access" avoids the crash, but is not acceptable for security reasons (I want to keep sandboxing enabled). The docs warn that danger-full-access disables sandboxing entirely. ([OpenAI Developers](https://developers.openai.com/codex/config-advanced/?utm_source=chatgpt.com "Advanced Configuration"))