fix: overhaul SandboxPolicy and config loading in Rust (#732)

Previous to this PR, `SandboxPolicy` was a bit difficult to work with:


237f8a11e1/codex-rs/core/src/protocol.rs (L98-L108)

Specifically:

* It was an `enum` and therefore options were mutually exclusive as
opposed to additive.
* It defined things in terms of what the agent _could not_ do as opposed
to what they _could_ do. This made things hard to support because we
would prefer to build up a sandbox config by starting with something
extremely restrictive and only granting permissions for things the user
as explicitly allowed.

This PR changes things substantially by redefining the policy in terms
of two concepts:

* A `SandboxPermission` enum that defines permissions that can be
granted to the agent/sandbox.
* A `SandboxPolicy` that internally stores a `Vec<SandboxPermission>`,
but externally exposes a simpler API that can be used to configure
Seatbelt/Landlock.

Previous to this PR, we supported a `--sandbox` flag that effectively
mapped to an enum value in `SandboxPolicy`. Though now that
`SandboxPolicy` is a wrapper around `Vec<SandboxPermission>`, the single
`--sandbox` flag no longer makes sense. While I could have turned it
into a flag that the user can specify multiple times, I think the
current values to use with such a flag are long and potentially messy,
so for the moment, I have dropped support for `--sandbox` altogether and
we can bring it back once we have figured out the naming thing.

Since `--sandbox` is gone, users now have to specify `--full-auto` to
get a sandbox that allows writes in `cwd`. Admittedly, there is no clean
way to specify the equivalent of `--full-auto` in your `config.toml`
right now, so we will have to revisit that, as well.

Because `Config` presents a `SandboxPolicy` field and `SandboxPolicy`
changed considerably, I had to overhaul how config loading works, as
well. There are now two distinct concepts, `ConfigToml` and `Config`:

* `ConfigToml` is the deserialization of `~/.codex/config.toml`. As one
might expect, every field is `Optional` and it is `#[derive(Deserialize,
Default)]`. Consistent use of `Optional` makes it clear what the user
has specified explicitly.
* `Config` is the "normalized config" and is produced by merging
`ConfigToml` with `ConfigOverrides`. Where `ConfigToml` contains a raw
`Option<Vec<SandboxPermission>>`, `Config` presents only the final
`SandboxPolicy`.

The changes to `core/src/exec.rs` and `core/src/linux.rs` merit extra
special attention to ensure we are faithfully mapping the
`SandboxPolicy` to the Seatbelt and Landlock configs, respectively.

Also, take note that `core/src/seatbelt_readonly_policy.sbpl` has been
renamed to `codex-rs/core/src/seatbelt_base_policy.sbpl` and that
`(allow file-read*)` has been removed from the `.sbpl` file as now this
is added to the policy in `core/src/exec.rs` when
`sandbox_policy.has_full_disk_read_access()` is `true`.

codex-rs/core/src/protocol.rs

@@ -93,44 +93,169 @@ pub enum AskForApproval {
 }
 
 /// Determines execution restrictions for model shell commands
-#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize)]
 #[serde(rename_all = "kebab-case")]
-pub enum SandboxPolicy {
-    /// Network syscalls will be blocked
-    NetworkRestricted,
-    /// Filesystem writes will be restricted
-    FileWriteRestricted,
-    /// Network and filesystem writes will be restricted
-    #[default]
-    NetworkAndFileWriteRestricted,
-    /// No restrictions; full "unsandboxed" mode
-    DangerousNoRestrictions,
+pub struct SandboxPolicy {
+    permissions: Vec<SandboxPermission>,
+}
+
+impl From<Vec<SandboxPermission>> for SandboxPolicy {
+    fn from(permissions: Vec<SandboxPermission>) -> Self {
+        Self { permissions }
+    }
 }
 
 impl SandboxPolicy {
-    pub fn is_dangerous(&self) -> bool {
-        match self {
-            SandboxPolicy::NetworkRestricted => false,
-            SandboxPolicy::FileWriteRestricted => false,
-            SandboxPolicy::NetworkAndFileWriteRestricted => false,
-            SandboxPolicy::DangerousNoRestrictions => true,
+    pub fn new_read_only_policy() -> Self {
+        Self {
+            permissions: vec![SandboxPermission::DiskFullReadAccess],
         }
     }
 
-    pub fn is_network_restricted(&self) -> bool {
-        matches!(
-            self,
-            SandboxPolicy::NetworkRestricted | SandboxPolicy::NetworkAndFileWriteRestricted
-        )
+    pub fn new_read_only_policy_with_writable_roots(writable_roots: &[PathBuf]) -> Self {
+        let mut permissions = Self::new_read_only_policy().permissions;
+        permissions.extend(writable_roots.iter().map(|folder| {
+            SandboxPermission::DiskWriteFolder {
+                folder: folder.clone(),
+            }
+        }));
+        Self { permissions }
     }
 
-    pub fn is_file_write_restricted(&self) -> bool {
-        matches!(
-            self,
-            SandboxPolicy::FileWriteRestricted | SandboxPolicy::NetworkAndFileWriteRestricted
-        )
+    pub fn new_full_auto_policy() -> Self {
+        Self {
+            permissions: vec![
+                SandboxPermission::DiskFullReadAccess,
+                SandboxPermission::DiskWritePlatformUserTempFolder,
+                SandboxPermission::DiskWriteCwd,
+            ],
+        }
+    }
+
+    pub fn new_full_auto_policy_with_writable_roots(writable_roots: &[PathBuf]) -> Self {
+        let mut permissions = Self::new_full_auto_policy().permissions;
+        permissions.extend(writable_roots.iter().map(|folder| {
+            SandboxPermission::DiskWriteFolder {
+                folder: folder.clone(),
+            }
+        }));
+        Self { permissions }
+    }
+
+    pub fn has_full_disk_read_access(&self) -> bool {
+        self.permissions
+            .iter()
+            .any(|perm| matches!(perm, SandboxPermission::DiskFullReadAccess))
+    }
+
+    pub fn has_full_disk_write_access(&self) -> bool {
+        self.permissions
+            .iter()
+            .any(|perm| matches!(perm, SandboxPermission::DiskFullWriteAccess))
+    }
+
+    pub fn has_full_network_access(&self) -> bool {
+        self.permissions
+            .iter()
+            .any(|perm| matches!(perm, SandboxPermission::NetworkFullAccess))
+    }
+
+    pub fn get_writable_roots(&self) -> Vec<PathBuf> {
+        let mut writable_roots = Vec::<PathBuf>::new();
+        for perm in &self.permissions {
+            use SandboxPermission::*;
+            match perm {
+                DiskWritePlatformUserTempFolder => {
+                    if cfg!(target_os = "macos") {
+                        if let Some(tempdir) = std::env::var_os("TMPDIR") {
+                            // Likely something that starts with /var/folders/...
+                            let tmpdir_path = PathBuf::from(&tempdir);
+                            if tmpdir_path.is_absolute() {
+                                writable_roots.push(tmpdir_path.clone());
+                                match tmpdir_path.canonicalize() {
+                                    Ok(canonicalized) => {
+                                        // Likely something that starts with /private/var/folders/...
+                                        if canonicalized != tmpdir_path {
+                                            writable_roots.push(canonicalized);
+                                        }
+                                    }
+                                    Err(e) => {
+                                        tracing::error!("Failed to canonicalize TMPDIR: {e}");
+                                    }
+                                }
+                            } else {
+                                tracing::error!("TMPDIR is not an absolute path: {tempdir:?}");
+                            }
+                        }
+                    }
+
+                    // For Linux, should this be XDG_RUNTIME_DIR, /run/user/<uid>, or something else?
+                }
+                DiskWritePlatformGlobalTempFolder => {
+                    if cfg!(unix) {
+                        writable_roots.push(PathBuf::from("/tmp"));
+                    }
+                }
+                DiskWriteCwd => match std::env::current_dir() {
+                    Ok(cwd) => writable_roots.push(cwd),
+                    Err(err) => {
+                        tracing::error!("Failed to get current working directory: {err}");
+                    }
+                },
+                DiskWriteFolder { folder } => {
+                    writable_roots.push(folder.clone());
+                }
+                DiskFullReadAccess | NetworkFullAccess => {}
+                DiskFullWriteAccess => {
+                    // Currently, we expect callers to only invoke this method
+                    // after verifying has_full_disk_write_access() is false.
+                }
+            }
+        }
+        writable_roots
+    }
+
+    pub fn is_unrestricted(&self) -> bool {
+        self.has_full_disk_read_access()
+            && self.has_full_disk_write_access()
+            && self.has_full_network_access()
     }
 }
+
+/// Permissions that should be granted to the sandbox in which the agent
+/// operates.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum SandboxPermission {
+    /// Is allowed to read all files on disk.
+    DiskFullReadAccess,
+
+    /// Is allowed to write to the operating system's temp dir that
+    /// is restricted to the user the agent is running as. For
+    /// example, on macOS, this is generally something under
+    /// `/var/folders` as opposed to `/tmp`.
+    DiskWritePlatformUserTempFolder,
+
+    /// Is allowed to write to the operating system's shared temp
+    /// dir. On UNIX, this is generally `/tmp`.
+    DiskWritePlatformGlobalTempFolder,
+
+    /// Is allowed to write to the current working directory (in practice, this
+    /// is the `cwd` where `codex` was spawned).
+    DiskWriteCwd,
+
+    /// Is allowed to the specified folder. `PathBuf` must be an
+    /// absolute path, though it is up to the caller to canonicalize
+    /// it if the path contains symlinks.
+    DiskWriteFolder { folder: PathBuf },
+
+    /// Is allowed to write to any file on disk.
+    DiskFullWriteAccess,
+
+    /// Can make arbitrary network requests.
+    NetworkFullAccess,
+}
+
 /// User input
 #[non_exhaustive]
 #[derive(Debug, Clone, Deserialize, Serialize)]