Git push --dry-run fails with Bad owner or permissions on /etc/ssh/ssh_config.d/... (SSH config owned by nobody inside sandbox)

What version of Codex is running?

codex-cli 0.84.0

What subscription do you have?

Pro

Which model were you using?

5.2-high (happens on all)

What platform is your computer?

Linux 6.18.3-arch1-1 x86_64

What terminal emulator and version are you using (if applicable)?

Ghostty

What issue are you seeing?

Trying to do a git push dry run from within Codex fails before auth/networking, because OpenSSH refuses to read system SSH config due to ownership/permissions.

Command:

git push --dry-run

Output:

Bad owner or permissions on /etc/ssh/ssh_config.d/20-systemd-ssh-proxy.conf
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

Also reproducible directly via ssh config parsing:

ssh -G github.com

Output:

Bad owner or permissions on /etc/ssh/ssh_config.d/20-systemd-ssh-proxy.conf

Key observation: inside this Codex environment, /etc/ssh and its config files are owned by nobody (uid 65534), which triggers OpenSSH’s safety checks.

Evidence:

whoami && id

root
uid=0(root) gid=0(root) groups=0(root),65534(nobody)

ls -ld /etc/ssh /etc/ssh/ssh_config.d

drwxr-xr-x 1 nobody nobody 344 Nov 27 19:09 /etc/ssh
drwxr-xr-x 1 nobody nobody 50 Jan 9 11:42 /etc/ssh/ssh_config.d

ls -l /etc/ssh/ssh_config.d/20-systemd-ssh-proxy.conf

lrwxrwxrwx 1 nobody nobody 63 Jan 6 18:29 /etc/ssh/ssh_config.d/20-systemd-ssh-proxy.conf -> ../../../usr/lib/systemd/ssh_config.d/20-systemd-ssh-proxy.conf

ls -l /usr/lib/systemd/ssh_config.d/20-systemd-ssh-proxy.conf

-rw-r--r-- 1 nobody nobody 807 Jan 6 18:29 /usr/lib/systemd/ssh_config.d/20-systemd-ssh-proxy.conf

What steps can reproduce the bug?

1. Start Codex CLI session in a git repo with an SSH remote (example above).
2. Run git push --dry-run.
3. Observe failure: Bad owner or permissions on /etc/ssh/ssh_config.d/20-systemd-ssh-proxy.conf.
4. Confirm /etc/ssh and /usr/lib/systemd/ssh_config.d/... are owned by nobody inside the Codex environment (commands above).

Notes:

• This appears to be an environment/sandbox regression: OpenSSH rejects system config because it is not owned by root (even though the process user is root).
• In the same session, codex --version prints a PATH-update warning (permission denied) which may be related.

What is the expected behavior?

• git push --dry-run should either:
• proceed to network/auth and succeed, or
• fail with an expected SSH auth error (e.g., missing key), or
• fail with a normal git remote/access error,
• but not fail immediately due to broken ownership of system SSH config files inside the Codex environment. Previous version worked perfectly.

Additional information

Codex sandbox/config observed in this session (from harness):

• sandbox_mode: workspace-write
• approval_policy: on-failure
• Network access: enabled

Tool versions:

• git --version: git version 2.52.0
• ssh -V: OpenSSH_10.2p1, OpenSSL 3.6.0 1 Oct 2025