Hello,
Please find attached two related patches that prevent Codex from
silently running restricted commands without sandbox enforcement.
OpenBSD does not currently provide a supported Codex sandbox backend.
pledge/unveil cannot reliably enforce these restrictions across
arbitrary subprocesses created through execve.
The first patch rejects managed sandbox profiles during configuration
and session creation.
The second rejects unsupported restrictions at command execution,
including managed network policies that cannot be enforced by a
proxy alone.
Both are necessary to cover the different execution paths.
Explicit danger-full-access execution remains available, as does
the option of running Codex inside external isolation.
Thanks,
David.
Index: devel/codex/patches/patch-codex-rs_config_src_constraint_rs
===================================================================
RCS file: devel/codex/patches/patch-codex-rs_config_src_constraint_rs
diff -N devel/codex/patches/patch-codex-rs_config_src_constraint_rs
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ devel/codex/patches/patch-codex-rs_config_src_constraint_rs 18 Oct 2026 16:10:35 -0000
@@ -0,0 +1,14 @@
+Index: codex-rs/config/src/constraint.rs
+--- codex-rs/config/src/constraint.rs.orig
++++ codex-rs/config/src/constraint.rs
+@@ -6,6 +6,10 @@ use thiserror::Error;
+
+ #[derive(Debug, Error, PartialEq, Eq)]
+ pub enum ConstraintError {
++ #[cfg(target_os = "openbsd")]
++ #[error("OpenBSD cannot enforce managed sandbox permissions; explicitly select danger-full-access or externally supplied isolation")]
++ OpenBsdManagedSandboxUnavailable,
++
+ #[error(
+ "invalid value for `{field_name}`: `{candidate}` is not in the allowed set {allowed} (set by {requirement_source})"
+ )]
Index: devel/codex/patches/patch-codex-rs_core_src_config_mod_rs_sandbox
===================================================================
RCS file: devel/codex/patches/patch-codex-rs_core_src_config_mod_rs_sandbox
diff -N devel/codex/patches/patch-codex-rs_core_src_config_mod_rs_sandbox
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ devel/codex/patches/patch-codex-rs_core_src_config_mod_rs_sandbox 18 Oct 2026 16:10:35 -0000
@@ -0,0 +1,19 @@
+Reject managed trusted-snapshot replacement on OpenBSD.
+
+Index: codex-rs/core/src/config/mod.rs
+--- codex-rs/core/src/config/mod.rs.orig
++++ codex-rs/core/src/config/mod.rs
+@@ -407,6 +407,13 @@ impl Permissions {
+ &mut self,
+ snapshot: PermissionProfileSnapshot,
+ ) -> ConstraintResult<()> {
++ #[cfg(target_os = "openbsd")]
++ if matches!(
++ snapshot.permission_profile(),
++ PermissionProfile::Managed { .. }
++ ) {
++ return Err(codex_config::ConstraintError::OpenBsdManagedSandboxUnavailable);
++ }
+ let permission_profile = Constrained::allow_only(snapshot.permission_profile().clone());
+ self.permission_profile_state =
+ PermissionProfileState::from_constrained_snapshot(permission_profile, snapshot)?;
Index: devel/codex/patches/patch-codex-rs_core_src_config_resolved_permission_profile_rs
===================================================================
RCS file: devel/codex/patches/patch-codex-rs_core_src_config_resolved_permission_profile_rs
diff -N devel/codex/patches/patch-codex-rs_core_src_config_resolved_permission_profile_rs
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ devel/codex/patches/patch-codex-rs_core_src_config_resolved_permission_profile_rs 18 Oct 2026 16:10:35 -0000
@@ -0,0 +1,45 @@
+Index: codex-rs/core/src/config/resolved_permission_profile.rs
+--- codex-rs/core/src/config/resolved_permission_profile.rs.orig
++++ codex-rs/core/src/config/resolved_permission_profile.rs
+@@ -11,6 +11,14 @@ pub(crate) struct PermissionProfileState
+ permission_profile: Constrained<PermissionProfileSnapshot>,
+ }
+
++#[cfg(target_os = "openbsd")]
++fn reject_openbsd_managed(permission_profile: &PermissionProfile) -> ConstraintResult<()> {
++ if matches!(permission_profile, PermissionProfile::Managed { .. }) {
++ return Err(codex_config::ConstraintError::OpenBsdManagedSandboxUnavailable);
++ }
++ Ok(())
++}
++
+ impl PermissionProfileState {
+ pub(crate) fn from_constrained_legacy(
+ constrained_permission_profile: Constrained<PermissionProfile>,
+@@ -72,6 +80,8 @@ impl PermissionProfileState {
+ &self,
+ permission_profile: &PermissionProfile,
+ ) -> ConstraintResult<()> {
++ #[cfg(target_os = "openbsd")]
++ reject_openbsd_managed(permission_profile)?;
+ let candidate = PermissionProfileSnapshot::legacy(permission_profile.clone());
+ self.permission_profile.can_set(&candidate)
+ }
+@@ -80,6 +90,8 @@ impl PermissionProfileState {
+ &mut self,
+ permission_profile: PermissionProfile,
+ ) -> ConstraintResult<()> {
++ #[cfg(target_os = "openbsd")]
++ reject_openbsd_managed(&permission_profile)?;
+ self.permission_profile
+ .set(PermissionProfileSnapshot::legacy(permission_profile))
+ }
+@@ -88,6 +100,8 @@ impl PermissionProfileState {
+ &mut self,
+ snapshot: PermissionProfileSnapshot,
+ ) -> ConstraintResult<()> {
++ #[cfg(target_os = "openbsd")]
++ reject_openbsd_managed(snapshot.permission_profile())?;
+ self.permission_profile.set(snapshot)
+ }
+ }
Index: devel/codex/patches/patch-codex-rs_core_src_session_mod_rs
===================================================================
RCS file: devel/codex/patches/patch-codex-rs_core_src_session_mod_rs
diff -N devel/codex/patches/patch-codex-rs_core_src_session_mod_rs
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ devel/codex/patches/patch-codex-rs_core_src_session_mod_rs 18 Oct 2026 16:10:35 -0000
@@ -0,0 +1,22 @@
+Reject managed sessions at the central session-spawn boundary. Configuration-only
+commands (login, doctor, MCP administration) and app-server startup remain usable.
+
+Index: codex-rs/core/src/session/mod.rs
+--- codex-rs/core/src/session/mod.rs.orig
++++ codex-rs/core/src/session/mod.rs
+@@ -593,6 +593,15 @@ impl Session {
+
+ async fn spawn_internal(args: SessionSpawnArgs) -> CodexResult<(Arc<Self>, SessionIo)> {
+ args.config.validate_windows_mxc_requirement()?;
++ #[cfg(target_os = "openbsd")]
++ if matches!(
++ args.config.permissions.permission_profile(),
++ PermissionProfile::Managed { .. }
++ ) {
++ return Err(CodexErr::UnsupportedOperation(
++ "OpenBSD cannot enforce a managed sandbox session; select explicit danger-full-access or external isolation".to_string(),
++ ));
++ }
+ let SessionSpawnArgs {
+ startup,
+ config,
