feat: experimental env var: CODEX_SANDBOX_NETWORK_DISABLED (#879)

When using Codex to develop Codex itself, I noticed that sometimes it
would try to add `#[ignore]` to the following tests:

```
keeps_previous_response_id_between_tasks()
retries_on_early_close()
```

Both of these tests start a `MockServer` that launches an HTTP server on
an ephemeral port and requires network access to hit it, which the
Seatbelt policy associated with `--full-auto` correctly denies. If I
wasn't paying attention to the code that Codex was generating, one of
these `#[ignore]` annotations could have slipped into the codebase,
effectively disabling the test for everyone.

To that end, this PR enables an experimental environment variable named
`CODEX_SANDBOX_NETWORK_DISABLED` that is set to `1` if the
`SandboxPolicy` used to spawn the process does not have full network
access. I say it is "experimental" because I'm not convinced this API is
quite right, but we need to start somewhere. (It might be more
appropriate to have an env var like `CODEX_SANDBOX=full-auto`, but the
challenge is that our newer `SandboxPolicy` abstraction does not map to
a simple set of enums like in the TypeScript CLI.)

We leverage this new functionality by adding the following code to the
aforementioned tests as a way to "dynamically disable" them:

```rust
if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
    println!(
        "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
    );
    return;
}
```

We can use the `debug seatbelt --full-auto` command to verify that
`cargo test` fails when run under Seatbelt prior to this change:

```
$ cargo run --bin codex -- debug seatbelt --full-auto -- cargo test
---- keeps_previous_response_id_between_tasks stdout ----

thread 'keeps_previous_response_id_between_tasks' panicked at /Users/mbolin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/wiremock-0.6.3/src/mock_server/builder.rs:107:46:
Failed to bind an OS port for a mock server.: Os { code: 1, kind: PermissionDenied, message: "Operation not permitted" }
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace


failures:
    keeps_previous_response_id_between_tasks

test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

error: test failed, to rerun pass `-p codex-core --test previous_response_id`
```

Though after this change, the above command succeeds! This means that,
going forward, when Codex operates on Codex itself, when it runs `cargo
test`, only "real failures" should cause the command to fail.

As part of this change, I decided to tighten up the codepaths for
running `exec()` for shell tool calls. In particular, we do it in `core`
for the main Codex business logic itself, but we also expose this logic
via `debug` subcommands in the CLI in the `cli` crate. The logic for the
`debug` subcommands was not quite as faithful to the true business logic
as I liked, so I:

* refactored a bit of the Linux code, splitting `linux.rs` into
`linux_exec.rs` and `landlock.rs` in the `core` crate.
* gating less code behind `#[cfg(target_os = "linux")]` because such
code does not get built by default when I develop on Mac, which means I
either have to build the code in Docker or wait for CI signal
* introduced `macro_rules! configure_command` in `exec.rs` so we can
have both sync and async versions of this code. The synchronous version
seems more appropriate for straight threads or potentially fork/exec.

codex-rs/core/src/landlock.rs

@@ -0,0 +1,319 @@
+use std::collections::BTreeMap;
+use std::path::Path;
+use std::path::PathBuf;
+
+use crate::error::CodexErr;
+use crate::error::Result;
+use crate::error::SandboxErr;
+use crate::protocol::SandboxPolicy;
+
+use landlock::ABI;
+use landlock::Access;
+use landlock::AccessFs;
+use landlock::CompatLevel;
+use landlock::Compatible;
+use landlock::Ruleset;
+use landlock::RulesetAttr;
+use landlock::RulesetCreatedAttr;
+use seccompiler::BpfProgram;
+use seccompiler::SeccompAction;
+use seccompiler::SeccompCmpArgLen;
+use seccompiler::SeccompCmpOp;
+use seccompiler::SeccompCondition;
+use seccompiler::SeccompFilter;
+use seccompiler::SeccompRule;
+use seccompiler::TargetArch;
+use seccompiler::apply_filter;
+
+/// Apply sandbox policies inside this thread so only the child inherits
+/// them, not the entire CLI process.
+pub(crate) fn apply_sandbox_policy_to_current_thread(
+    sandbox_policy: &SandboxPolicy,
+    cwd: &Path,
+) -> Result<()> {
+    if !sandbox_policy.has_full_network_access() {
+        install_network_seccomp_filter_on_current_thread()?;
+    }
+
+    if !sandbox_policy.has_full_disk_write_access() {
+        let writable_roots = sandbox_policy.get_writable_roots_with_cwd(cwd);
+        install_filesystem_landlock_rules_on_current_thread(writable_roots)?;
+    }
+
+    // TODO(ragona): Add appropriate restrictions if
+    // `sandbox_policy.has_full_disk_read_access()` is `false`.
+
+    Ok(())
+}
+
+/// Installs Landlock file-system rules on the current thread allowing read
+/// access to the entire file-system while restricting write access to
+/// `/dev/null` and the provided list of `writable_roots`.
+///
+/// # Errors
+/// Returns [`CodexErr::Sandbox`] variants when the ruleset fails to apply.
+fn install_filesystem_landlock_rules_on_current_thread(writable_roots: Vec<PathBuf>) -> Result<()> {
+    let abi = ABI::V5;
+    let access_rw = AccessFs::from_all(abi);
+    let access_ro = AccessFs::from_read(abi);
+
+    let mut ruleset = Ruleset::default()
+        .set_compatibility(CompatLevel::BestEffort)
+        .handle_access(access_rw)?
+        .create()?
+        .add_rules(landlock::path_beneath_rules(&["/"], access_ro))?
+        .add_rules(landlock::path_beneath_rules(&["/dev/null"], access_rw))?
+        .set_no_new_privs(true);
+
+    if !writable_roots.is_empty() {
+        ruleset = ruleset.add_rules(landlock::path_beneath_rules(&writable_roots, access_rw))?;
+    }
+
+    let status = ruleset.restrict_self()?;
+
+    if status.ruleset == landlock::RulesetStatus::NotEnforced {
+        return Err(CodexErr::Sandbox(SandboxErr::LandlockRestrict));
+    }
+
+    Ok(())
+}
+
+/// Installs a seccomp filter that blocks outbound network access except for
+/// AF_UNIX domain sockets.
+fn install_network_seccomp_filter_on_current_thread() -> std::result::Result<(), SandboxErr> {
+    // Build rule map.
+    let mut rules: BTreeMap<i64, Vec<SeccompRule>> = BTreeMap::new();
+
+    // Helper – insert unconditional deny rule for syscall number.
+    let mut deny_syscall = |nr: i64| {
+        rules.insert(nr, vec![]); // empty rule vec = unconditional match
+    };
+
+    deny_syscall(libc::SYS_connect);
+    deny_syscall(libc::SYS_accept);
+    deny_syscall(libc::SYS_accept4);
+    deny_syscall(libc::SYS_bind);
+    deny_syscall(libc::SYS_listen);
+    deny_syscall(libc::SYS_getpeername);
+    deny_syscall(libc::SYS_getsockname);
+    deny_syscall(libc::SYS_shutdown);
+    deny_syscall(libc::SYS_sendto);
+    deny_syscall(libc::SYS_sendmsg);
+    deny_syscall(libc::SYS_sendmmsg);
+    deny_syscall(libc::SYS_recvfrom);
+    deny_syscall(libc::SYS_recvmsg);
+    deny_syscall(libc::SYS_recvmmsg);
+    deny_syscall(libc::SYS_getsockopt);
+    deny_syscall(libc::SYS_setsockopt);
+    deny_syscall(libc::SYS_ptrace);
+
+    // For `socket` we allow AF_UNIX (arg0 == AF_UNIX) and deny everything else.
+    let unix_only_rule = SeccompRule::new(vec![SeccompCondition::new(
+        0, // first argument (domain)
+        SeccompCmpArgLen::Dword,
+        SeccompCmpOp::Eq,
+        libc::AF_UNIX as u64,
+    )?])?;
+
+    rules.insert(libc::SYS_socket, vec![unix_only_rule]);
+    rules.insert(libc::SYS_socketpair, vec![]); // always deny (Unix can use socketpair but fine, keep open?)
+
+    let filter = SeccompFilter::new(
+        rules,
+        SeccompAction::Allow,                     // default – allow
+        SeccompAction::Errno(libc::EPERM as u32), // when rule matches – return EPERM
+        if cfg!(target_arch = "x86_64") {
+            TargetArch::x86_64
+        } else if cfg!(target_arch = "aarch64") {
+            TargetArch::aarch64
+        } else {
+            unimplemented!("unsupported architecture for seccomp filter");
+        },
+    )?;
+
+    let prog: BpfProgram = filter.try_into()?;
+
+    apply_filter(&prog)?;
+
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used)]
+
+    use super::*;
+    use crate::exec::ExecParams;
+    use crate::exec::SandboxType;
+    use crate::exec::process_exec_tool_call;
+    use crate::protocol::SandboxPolicy;
+    use std::sync::Arc;
+    use tempfile::NamedTempFile;
+    use tokio::sync::Notify;
+
+    #[allow(clippy::print_stdout)]
+    async fn run_cmd(cmd: &[&str], writable_roots: &[PathBuf], timeout_ms: u64) {
+        let params = ExecParams {
+            command: cmd.iter().map(|elm| elm.to_string()).collect(),
+            cwd: std::env::current_dir().expect("cwd should exist"),
+            timeout_ms: Some(timeout_ms),
+        };
+
+        let sandbox_policy =
+            SandboxPolicy::new_read_only_policy_with_writable_roots(writable_roots);
+        let ctrl_c = Arc::new(Notify::new());
+        let res =
+            process_exec_tool_call(params, SandboxType::LinuxSeccomp, ctrl_c, &sandbox_policy)
+                .await
+                .unwrap();
+
+        if res.exit_code != 0 {
+            println!("stdout:\n{}", res.stdout);
+            println!("stderr:\n{}", res.stderr);
+            panic!("exit code: {}", res.exit_code);
+        }
+    }
+
+    #[tokio::test]
+    async fn test_root_read() {
+        run_cmd(&["ls", "-l", "/bin"], &[], 200).await;
+    }
+
+    #[tokio::test]
+    #[should_panic]
+    async fn test_root_write() {
+        let tmpfile = NamedTempFile::new().unwrap();
+        let tmpfile_path = tmpfile.path().to_string_lossy();
+        run_cmd(
+            &["bash", "-lc", &format!("echo blah > {}", tmpfile_path)],
+            &[],
+            200,
+        )
+        .await;
+    }
+
+    #[tokio::test]
+    async fn test_dev_null_write() {
+        run_cmd(&["echo", "blah", ">", "/dev/null"], &[], 200).await;
+    }
+
+    #[tokio::test]
+    async fn test_writable_root() {
+        let tmpdir = tempfile::tempdir().unwrap();
+        let file_path = tmpdir.path().join("test");
+        run_cmd(
+            &[
+                "bash",
+                "-lc",
+                &format!("echo blah > {}", file_path.to_string_lossy()),
+            ],
+            &[tmpdir.path().to_path_buf()],
+            // We have seen timeouts when running this test in CI on GitHub,
+            // so we are using a generous timeout until we can diagnose further.
+            1_000,
+        )
+        .await;
+    }
+
+    #[tokio::test]
+    #[should_panic(expected = "Sandbox(Timeout)")]
+    async fn test_timeout() {
+        run_cmd(&["sleep", "2"], &[], 50).await;
+    }
+
+    /// Helper that runs `cmd` under the Linux sandbox and asserts that the command
+    /// does NOT succeed (i.e. returns a non‑zero exit code) **unless** the binary
+    /// is missing in which case we silently treat it as an accepted skip so the
+    /// suite remains green on leaner CI images.
+    async fn assert_network_blocked(cmd: &[&str]) {
+        let params = ExecParams {
+            command: cmd.iter().map(|s| s.to_string()).collect(),
+            cwd: std::env::current_dir().expect("cwd should exist"),
+            // Give the tool a generous 2‑second timeout so even slow DNS timeouts
+            // do not stall the suite.
+            timeout_ms: Some(2_000),
+        };
+
+        let sandbox_policy = SandboxPolicy::new_read_only_policy();
+        let ctrl_c = Arc::new(Notify::new());
+        let result =
+            process_exec_tool_call(params, SandboxType::LinuxSeccomp, ctrl_c, &sandbox_policy)
+                .await;
+
+        let (exit_code, stdout, stderr) = match result {
+            Ok(output) => (output.exit_code, output.stdout, output.stderr),
+            Err(CodexErr::Sandbox(SandboxErr::Denied(exit_code, stdout, stderr))) => {
+                (exit_code, stdout, stderr)
+            }
+            _ => {
+                panic!("expected sandbox denied error, got: {:?}", result);
+            }
+        };
+
+        dbg!(&stderr);
+        dbg!(&stdout);
+        dbg!(&exit_code);
+
+        // A completely missing binary exits with 127.  Anything else should also
+        // be non‑zero (EPERM from seccomp will usually bubble up as 1, 2, 13…)
+        // If—*and only if*—the command exits 0 we consider the sandbox breached.
+
+        if exit_code == 0 {
+            panic!(
+                "Network sandbox FAILED - {:?} exited 0\nstdout:\n{}\nstderr:\n{}",
+                cmd, stdout, stderr
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn sandbox_blocks_curl() {
+        assert_network_blocked(&["curl", "-I", "http://openai.com"]).await;
+    }
+
+    #[cfg(target_os = "linux")]
+    #[tokio::test]
+    async fn sandbox_blocks_wget() {
+        assert_network_blocked(&["wget", "-qO-", "http://openai.com"]).await;
+    }
+
+    #[tokio::test]
+    async fn sandbox_blocks_ping() {
+        // ICMP requires raw socket – should be denied quickly with EPERM.
+        assert_network_blocked(&["ping", "-c", "1", "8.8.8.8"]).await;
+    }
+
+    #[tokio::test]
+    async fn sandbox_blocks_nc() {
+        // Zero‑length connection attempt to localhost.
+        assert_network_blocked(&["nc", "-z", "127.0.0.1", "80"]).await;
+    }
+
+    #[tokio::test]
+    async fn sandbox_blocks_ssh() {
+        // Force ssh to attempt a real TCP connection but fail quickly.  `BatchMode`
+        // avoids password prompts, and `ConnectTimeout` keeps the hang time low.
+        assert_network_blocked(&[
+            "ssh",
+            "-o",
+            "BatchMode=yes",
+            "-o",
+            "ConnectTimeout=1",
+            "github.com",
+        ])
+        .await;
+    }
+
+    #[tokio::test]
+    async fn sandbox_blocks_getent() {
+        assert_network_blocked(&["getent", "ahosts", "openai.com"]).await;
+    }
+
+    #[tokio::test]
+    async fn sandbox_blocks_dev_tcp_redirection() {
+        // This syntax is only supported by bash and zsh. We try bash first.
+        // Fallback generic socket attempt using /bin/sh with bash‑style /dev/tcp.  Not
+        // all images ship bash, so we guard against 127 as well.
+        assert_network_blocked(&["bash", "-c", "echo hi > /dev/tcp/127.0.0.1/80"]).await;
+    }
+}