add codex debug seatbelt --log-denials #4098
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
Codex Review: Here are some suggestions.
About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you open a pull request for review, mark a draft as ready, or comment "@codex review". If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex fix this CI failure" or "@codex address that feedback".
| unsafe extern "C" { | ||
| fn proc_listchildpids( | ||
| ppid: libc::c_int, | ||
| buffer: *mut libc::c_void, | ||
| buffersize: libc::c_int, | ||
| ) -> libc::c_int; | ||
| } |
There was a problem hiding this comment.
[P1] Link libproc for proc_listchildpids FFI
The new PID tracker calls proc_listchildpids directly, but the file doesn’t link the libproc library. On macOS these symbols live in libproc rather than libSystem, so without an explicit #[link(name = "proc")] (or using a crate that provides it) the CLI will fail to link with an undefined symbol error when --log-denials is built. Add the missing link attribute so the code compiles.
Useful? React with 👍 / 👎.
|
@nornagon-openai this appears to add a new folder named |
|
@bolinfest oops, some test code unintentionally committed. Removed. |
|
@nornagon-openai the builds are red and Codex seems to have flagged some potential link issues? |
|
@bolinfest CI is green now, and Codex's review comment seems spurious to me. The build works fine on macOS, as evidenced by the fact that CI is green :D |
codex-rs/cli/src/debug_sandbox.rs
Outdated
| Landlock, | ||
| } | ||
|
|
||
| #[cfg_attr(not(target_os = "macos"), allow(unused_variables))] |
There was a problem hiding this comment.
It would be nice to have allow(unused_variables) more tightly scoped.
This adds a debugging tool for analyzing why certain commands fail to execute under the sandbox.
Example output:
It operates by:
log streamto watch system logs, andthis is a "best-effort" technique, as
log streammay drop logs(?), and kqueue + proc_listchildpids isn't atomic and can end up missing very short-lived processes. But it works well enough in my testing to be useful :)