linux-sandbox: plumb split sandbox policies through helper

codex-rs/core/src/landlock.rs

@@ -3,6 +3,7 @@ use crate::spawn::SpawnChildRequest;
 use crate::spawn::StdioPolicy;
 use crate::spawn::spawn_child_async;
 use codex_network_proxy::NetworkProxy;
+use codex_protocol::permissions::FileSystemSandboxPolicy;
 use codex_protocol::permissions::NetworkSandboxPolicy;
 use std::collections::HashMap;
 use std::path::Path;
@@ -14,9 +15,9 @@ use tokio::process::Child;
 /// isolation plus seccomp for network restrictions.
 ///
 /// Unlike macOS Seatbelt where we directly embed the policy text, the Linux
-/// helper accepts a list of `--sandbox-permission`/`-s` flags mirroring the
-/// public CLI. We convert the internal [`SandboxPolicy`] representation into
-/// the equivalent CLI options.
+/// helper is a separate executable. We pass the legacy [`SandboxPolicy`] plus
+/// split filesystem/network policies as JSON so the helper can migrate
+/// incrementally without breaking older call sites.
 #[allow(clippy::too_many_arguments)]
 pub async fn spawn_command_under_linux_sandbox<P>(
     codex_linux_sandbox_exe: P,
@@ -32,9 +33,13 @@ pub async fn spawn_command_under_linux_sandbox<P>(
 where
     P: AsRef<Path>,
 {
-    let args = create_linux_sandbox_command_args(
+    let file_system_sandbox_policy = FileSystemSandboxPolicy::from(sandbox_policy);
+    let network_sandbox_policy = NetworkSandboxPolicy::from(sandbox_policy);
+    let args = create_linux_sandbox_command_args_for_policies(
         command,
         sandbox_policy,
+        &file_system_sandbox_policy,
+        network_sandbox_policy,
         sandbox_policy_cwd,
         use_bwrap_sandbox,
         allow_network_for_proxy(false),
@@ -45,7 +50,7 @@ where
         args,
         arg0,
         cwd: command_cwd,
-        network_sandbox_policy: NetworkSandboxPolicy::from(sandbox_policy),
+        network_sandbox_policy,
         network,
         stdio_policy,
         env,
@@ -60,39 +65,76 @@ pub(crate) fn allow_network_for_proxy(enforce_managed_network: bool) -> bool {
     enforce_managed_network
 }
 
-/// Converts the sandbox policy into the CLI invocation for `codex-linux-sandbox`.
+/// Converts the sandbox policies into the CLI invocation for
+/// `codex-linux-sandbox`.
 ///
 /// The helper performs the actual sandboxing (bubblewrap + seccomp) after
-/// parsing these arguments. See `docs/linux_sandbox.md` for the Linux semantics.
-pub(crate) fn create_linux_sandbox_command_args(
+/// parsing these arguments. Policy JSON flags are emitted before helper feature
+/// flags so the argv order matches the helper's CLI shape. See
+/// `docs/linux_sandbox.md` for the Linux semantics.
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn create_linux_sandbox_command_args_for_policies(
     command: Vec<String>,
     sandbox_policy: &SandboxPolicy,
+    file_system_sandbox_policy: &FileSystemSandboxPolicy,
+    network_sandbox_policy: NetworkSandboxPolicy,
     sandbox_policy_cwd: &Path,
     use_bwrap_sandbox: bool,
     allow_network_for_proxy: bool,
 ) -> Vec<String> {
-    #[expect(clippy::expect_used)]
+    let sandbox_policy_json = serde_json::to_string(sandbox_policy)
+        .unwrap_or_else(|err| panic!("failed to serialize sandbox policy: {err}"));
+    let file_system_policy_json = serde_json::to_string(file_system_sandbox_policy)
+        .unwrap_or_else(|err| panic!("failed to serialize filesystem sandbox policy: {err}"));
+    let network_policy_json = serde_json::to_string(&network_sandbox_policy)
+        .unwrap_or_else(|err| panic!("failed to serialize network sandbox policy: {err}"));
     let sandbox_policy_cwd = sandbox_policy_cwd
         .to_str()
-        .expect("cwd must be valid UTF-8")
+        .unwrap_or_else(|| panic!("cwd must be valid UTF-8"))
         .to_string();
 
-    #[expect(clippy::expect_used)]
-    let sandbox_policy_json =
-        serde_json::to_string(sandbox_policy).expect("Failed to serialize SandboxPolicy to JSON");
-
     let mut linux_cmd: Vec<String> = vec![
         "--sandbox-policy-cwd".to_string(),
         sandbox_policy_cwd,
         "--sandbox-policy".to_string(),
         sandbox_policy_json,
+        "--file-system-sandbox-policy".to_string(),
+        file_system_policy_json,
+        "--network-sandbox-policy".to_string(),
+        network_policy_json,
     ];
     if use_bwrap_sandbox {
         linux_cmd.push("--use-bwrap-sandbox".to_string());
     }
     if allow_network_for_proxy {
         linux_cmd.push("--allow-network-for-proxy".to_string());
     }
+    linux_cmd.push("--".to_string());
+    linux_cmd.extend(command);
+    linux_cmd
+}
+
+/// Converts the sandbox cwd and execution options into the CLI invocation for
+/// `codex-linux-sandbox`.
+#[cfg(test)]
+pub(crate) fn create_linux_sandbox_command_args(
+    command: Vec<String>,
+    sandbox_policy_cwd: &Path,
+    use_bwrap_sandbox: bool,
+    allow_network_for_proxy: bool,
+) -> Vec<String> {
+    let sandbox_policy_cwd = sandbox_policy_cwd
+        .to_str()
+        .unwrap_or_else(|| panic!("cwd must be valid UTF-8"))
+        .to_string();
+
+    let mut linux_cmd: Vec<String> = vec!["--sandbox-policy-cwd".to_string(), sandbox_policy_cwd];
+    if use_bwrap_sandbox {
+        linux_cmd.push("--use-bwrap-sandbox".to_string());
+    }
+    if allow_network_for_proxy {
+        linux_cmd.push("--allow-network-for-proxy".to_string());
+    }
 
     // Separator so that command arguments starting with `-` are not parsed as
     // options of the helper itself.
@@ -113,16 +155,14 @@ mod tests {
     fn bwrap_flags_are_feature_gated() {
         let command = vec!["/bin/true".to_string()];
         let cwd = Path::new("/tmp");
-        let policy = SandboxPolicy::new_read_only_policy();
 
-        let with_bwrap =
-            create_linux_sandbox_command_args(command.clone(), &policy, cwd, true, false);
+        let with_bwrap = create_linux_sandbox_command_args(command.clone(), cwd, true, false);
         assert_eq!(
             with_bwrap.contains(&"--use-bwrap-sandbox".to_string()),
             true
         );
 
-        let without_bwrap = create_linux_sandbox_command_args(command, &policy, cwd, false, false);
+        let without_bwrap = create_linux_sandbox_command_args(command, cwd, false, false);
         assert_eq!(
             without_bwrap.contains(&"--use-bwrap-sandbox".to_string()),
             false
@@ -133,15 +173,46 @@ mod tests {
     fn proxy_flag_is_included_when_requested() {
         let command = vec!["/bin/true".to_string()];
         let cwd = Path::new("/tmp");
-        let policy = SandboxPolicy::new_read_only_policy();
 
-        let args = create_linux_sandbox_command_args(command, &policy, cwd, true, true);
+        let args = create_linux_sandbox_command_args(command, cwd, true, true);
         assert_eq!(
             args.contains(&"--allow-network-for-proxy".to_string()),
             true
         );
     }
 
+    #[test]
+    fn split_policy_flags_are_included() {
+        let command = vec!["/bin/true".to_string()];
+        let cwd = Path::new("/tmp");
+        let sandbox_policy = SandboxPolicy::new_read_only_policy();
+        let file_system_sandbox_policy = FileSystemSandboxPolicy::from(&sandbox_policy);
+        let network_sandbox_policy = NetworkSandboxPolicy::from(&sandbox_policy);
+
+        let args = create_linux_sandbox_command_args_for_policies(
+            command,
+            &sandbox_policy,
+            &file_system_sandbox_policy,
+            network_sandbox_policy,
+            cwd,
+            true,
+            false,
+        );
+
+        assert_eq!(
+            args.windows(2).any(|window| {
+                window[0] == "--file-system-sandbox-policy" && !window[1].is_empty()
+            }),
+            true
+        );
+        assert_eq!(
+            args.windows(2)
+                .any(|window| window[0] == "--network-sandbox-policy"
+                    && window[1] == "\"restricted\""),
+            true
+        );
+    }
+
     #[test]
     fn proxy_network_requires_managed_requirements() {
         assert_eq!(allow_network_for_proxy(false), false);

codex-rs/core/src/sandboxing/mod.rs

@@ -14,7 +14,7 @@ use crate::exec::SandboxType;
 use crate::exec::StdoutStream;
 use crate::exec::execute_exec_request;
 use crate::landlock::allow_network_for_proxy;
-use crate::landlock::create_linux_sandbox_command_args;
+use crate::landlock::create_linux_sandbox_command_args_for_policies;
 use crate::protocol::SandboxPolicy;
 #[cfg(target_os = "macos")]
 use crate::seatbelt::MACOS_PATH_TO_SEATBELT_EXECUTABLE;
@@ -516,9 +516,11 @@ impl SandboxManager {
                 let exe = codex_linux_sandbox_exe
                     .ok_or(SandboxTransformError::MissingLinuxSandboxExecutable)?;
                 let allow_proxy_network = allow_network_for_proxy(enforce_managed_network);
-                let mut args = create_linux_sandbox_command_args(
+                let mut args = create_linux_sandbox_command_args_for_policies(
                     command.clone(),
                     &effective_policy,
+                    &effective_file_system_policy,
+                    effective_network_policy,
                     sandbox_policy_cwd,
                     use_linux_sandbox_bwrap,
                     allow_proxy_network,

codex-rs/linux-sandbox/src/landlock.rs

@@ -8,6 +8,7 @@ use std::path::Path;
 use codex_core::error::CodexErr;
 use codex_core::error::Result;
 use codex_core::error::SandboxErr;
+use codex_protocol::protocol::NetworkSandboxPolicy;
 use codex_protocol::protocol::SandboxPolicy;
 use codex_utils_absolute_path::AbsolutePathBuf;
 
@@ -40,13 +41,14 @@ use seccompiler::apply_filter;
 /// Filesystem restrictions are intentionally handled by bubblewrap.
 pub(crate) fn apply_sandbox_policy_to_current_thread(
     sandbox_policy: &SandboxPolicy,
+    network_sandbox_policy: NetworkSandboxPolicy,
     cwd: &Path,
     apply_landlock_fs: bool,
     allow_network_for_proxy: bool,
     proxy_routed_network: bool,
 ) -> Result<()> {
     let network_seccomp_mode = network_seccomp_mode(
-        sandbox_policy,
+        network_sandbox_policy,
         allow_network_for_proxy,
         proxy_routed_network,
     );
@@ -91,20 +93,20 @@ enum NetworkSeccompMode {
 }
 
 fn should_install_network_seccomp(
-    sandbox_policy: &SandboxPolicy,
+    network_sandbox_policy: NetworkSandboxPolicy,
     allow_network_for_proxy: bool,
 ) -> bool {
     // Managed-network sessions should remain fail-closed even for policies that
     // would normally grant full network access (for example, DangerFullAccess).
-    !sandbox_policy.has_full_network_access() || allow_network_for_proxy
+    !network_sandbox_policy.is_enabled() || allow_network_for_proxy
 }
 
 fn network_seccomp_mode(
-    sandbox_policy: &SandboxPolicy,
+    network_sandbox_policy: NetworkSandboxPolicy,
     allow_network_for_proxy: bool,
     proxy_routed_network: bool,
 ) -> Option<NetworkSeccompMode> {
-    if !should_install_network_seccomp(sandbox_policy, allow_network_for_proxy) {
+    if !should_install_network_seccomp(network_sandbox_policy, allow_network_for_proxy) {
         None
     } else if proxy_routed_network {
         Some(NetworkSeccompMode::ProxyRouted)
@@ -266,57 +268,57 @@ mod tests {
     use super::NetworkSeccompMode;
     use super::network_seccomp_mode;
     use super::should_install_network_seccomp;
-    use codex_protocol::protocol::SandboxPolicy;
+    use codex_protocol::protocol::NetworkSandboxPolicy;
     use pretty_assertions::assert_eq;
 
     #[test]
     fn managed_network_enforces_seccomp_even_for_full_network_policy() {
         assert_eq!(
-            should_install_network_seccomp(&SandboxPolicy::DangerFullAccess, true),
+            should_install_network_seccomp(NetworkSandboxPolicy::Enabled, true),
             true
         );
     }
 
     #[test]
     fn full_network_policy_without_managed_network_skips_seccomp() {
         assert_eq!(
-            should_install_network_seccomp(&SandboxPolicy::DangerFullAccess, false),
+            should_install_network_seccomp(NetworkSandboxPolicy::Enabled, false),
             false
         );
     }
 
     #[test]
     fn restricted_network_policy_always_installs_seccomp() {
         assert!(should_install_network_seccomp(
-            &SandboxPolicy::new_read_only_policy(),
+            NetworkSandboxPolicy::Restricted,
             false
         ));
         assert!(should_install_network_seccomp(
-            &SandboxPolicy::new_read_only_policy(),
+            NetworkSandboxPolicy::Restricted,
             true
         ));
     }
 
     #[test]
     fn managed_proxy_routes_use_proxy_routed_seccomp_mode() {
         assert_eq!(
-            network_seccomp_mode(&SandboxPolicy::DangerFullAccess, true, true),
+            network_seccomp_mode(NetworkSandboxPolicy::Enabled, true, true),
             Some(NetworkSeccompMode::ProxyRouted)
         );
     }
 
     #[test]
     fn restricted_network_without_proxy_routing_uses_restricted_mode() {
         assert_eq!(
-            network_seccomp_mode(&SandboxPolicy::new_read_only_policy(), false, false),
+            network_seccomp_mode(NetworkSandboxPolicy::Restricted, false, false),
             Some(NetworkSeccompMode::Restricted)
         );
     }
 
     #[test]
     fn full_network_without_managed_proxy_skips_network_seccomp_mode() {
         assert_eq!(
-            network_seccomp_mode(&SandboxPolicy::DangerFullAccess, false, false),
+            network_seccomp_mode(NetworkSandboxPolicy::Enabled, false, false),
             None
         );
     }