[flagged]
A way to exclude sensitive files issue still open for OpenAI Codex
151–157 of 157 posts
Re: A way to exclude sensitive files issue still open for OpenAI Codex
#152We have had a solution for this built into Codex for several months now. It is marked "Beta" in the docs because we have been tweaking the config API here and there, but a number of folks have been using it for quite awhile and I would recommend switching to it and reporting any issues you find:
https://developers.openai.com/codex/permissions
With permission profiles in Codex, you can:
- Mark a path, glob, or meta variable (like `:workspace_roots`) readable, writable, or unreadable. - Amend an existing profile using ordinary `config.toml` layering rules. - Create a new profile by extending an existing one (`extends = ":workspace"` is generally what you want to do).
Note that permission profiles also allow you to configure the network proxy for the sandbox in a fine-grained way. (Previously, the network options for the Codex sandbox were all or nothing.)
Finally, you can also test running a command under a permission profile using:
codex sandbox -P PROFILE_NAME -- PROGRAM ARGS...
Our goal has been to provide something powerful and flexible out of the box so you do not need to bolt on other solutions like the ones mentioned on this thread.
Re: A way to exclude sensitive files issue still open for OpenAI Codex
#153Earlier quoted context omitted.
I use this: https://github.com/kstenerud/yoloai yoloai new mysandbox . # Create a sandbox yoloai attach mysandbox # Attach the sandbox to the current terminal ... (^b^d to disconnect) # It's using tmux to keep the agent alive yoloai diff mysandbox # See what the agent did yoloai apply mysandbox # apply its changes to your workdir yoloai destroy sandbox You can also make it run a prompt and block until it's done: yolo…
thanks. I will check that out, I'm also checking out smolvm. Sometimes it is hard to distinguish my modest needs versus what might be needed at a corporate infrastructure level for coding or agent orchestration. I'm just writing scripts for neuroimaging analysis, etc, and want to ensure codex etc doesn't read my sqlite db or csvs, and send my research data to the inference provider... Are people using these and inter…
The problem is that sandbox security is a VERY HARD problem that seems deceptively simple. I started out modestly, and yoloAI is the result of all of the problems I encountered along the way.
Re: A way to exclude sensitive files issue still open for OpenAI Codex
#154Earlier quoted context omitted.
A good but altogether separate note from the point I’m making: this lack of access is seen as an obstacle to overcome, and other means of access will be tried if available. It’s a different mental model than a first party solution to “ignore” files.
Weirdly, the existing first party solutions around denying commands don't seem to help here. Often enough, when one of the agents prompts for running "sudo", and I reject it, it will do what looks very much like malicious exploration to figure out how to handle things anyway, including once hijacking a separate shell's pty where I did have a valid sudo session already in order to execute some commands. We don't yet h…
OTOH it lets you file a bug report :)
As opposed to, "well, you should have ran it in a container if you didn't want your baby photos deleted"
Re: A way to exclude sensitive files issue still open for OpenAI Codex
#155Earlier quoted context omitted.
>> bash actually has a "restricted" mode ... > Does that work? I've never seen it used. It seems easy to escape. Yes, it does work for its intended purpose. It has often been used in combination with chroot[0] as well. > The docs seem to suggest using alternate approaches. >> Modern systems provide more secure ways to implement a restricted environment, such as jails, zones, or containers. These approaches are not mu…
I'm seeing a ton of restricted mode escapes documented online, like https://0xffsec.com/handbook/shells/restricted-shells/ so I'm not so sure. When basic utilities like less, man, and awk can run subshells it's quite a mess. Bash restricted mode needing a chroot may suggest that Claude also needs a chroot (or restricted file permissions, jail, etc).
> Bash restricted mode needing a chroot may suggest that Claude also needs a chroot (or restricted file permissions, jail, etc).
I believe running coding agents within a jail/container is a "best practice" to limit their blast radius. At least, this is what people I respect have conveyed to me.
Re: A way to exclude sensitive files issue still open for OpenAI Codex
#156Earlier quoted context omitted.
Yes. I found this quickly after wrapping codex in a launcher that uses bubblewrap to exclude certain files and directories based on a config file at the project root. My best solution so far is to also include instructions for the agent that explain that it is not allowed to see certain files, and that their inaccessibility is not an error, and that it must not attempt to access them through other means (e.g. via git…
Interesting you said it's not foolproof. Did the agent ignore your instruction somehow?
no, but there's no guarantee that it won't, just like any instructions.
Re: A way to exclude sensitive files issue still open for OpenAI Codex
#157[flagged]