{"record":{"id":"0bcc04705821f0a7","repo":"openai/codex","slug":"unsupported-architecture-for-seccomp-filter","errorCode":null,"errorMessage":"unsupported architecture for seccomp filter","messagePattern":"unsupported architecture for seccomp filter","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"codex-rs/linux-sandbox/src/landlock.rs","lineNumber":259,"sourceCode":"                SeccompCmpArgLen::Dword,\n                SeccompCmpOp::Ne,\n                libc::AF_UNIX as u64,\n            )?])?;\n            rules.insert(libc::SYS_socket, vec![deny_non_ip_socket]);\n            rules.insert(libc::SYS_socketpair, vec![deny_non_unix_socketpair]);\n        }\n    }\n\n    let filter = SeccompFilter::new(\n        rules,\n        SeccompAction::Allow,                     // default – allow\n        SeccompAction::Errno(libc::EPERM as u32), // when rule matches – return EPERM\n        if cfg!(target_arch = \"x86_64\") {\n            TargetArch::x86_64\n        } else if cfg!(target_arch = \"aarch64\") {\n            TargetArch::aarch64\n        } else {\n            unimplemented!(\"unsupported architecture for seccomp filter\");\n        },\n    )?;\n\n    let prog: BpfProgram = filter.try_into()?;\n\n    apply_filter(&prog)?;\n\n    Ok(())\n}\n\n#[cfg(test)]\nmod tests {\n    use super::NetworkSeccompMode;\n    use super::network_seccomp_mode;\n    use super::should_install_network_seccomp;\n    use codex_protocol::protocol::NetworkSandboxPolicy;\n    use pretty_assertions::assert_eq;\n","sourceCodeStart":241,"sourceCodeEnd":277,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/linux-sandbox/src/landlock.rs#L241-L277","documentation":"install_network_seccomp_filter_on_current_thread compiles a seccomp BPF filter whose TargetArch is selected with cfg!(target_arch). Only x86_64 and aarch64 are mapped; on any other Linux architecture the code reaches unimplemented!() and panics whenever a network policy requires the filter (a restricted policy, or an enabled policy under managed networking).","triggerScenarios":"Running the Codex Linux sandbox with NetworkSandboxPolicy::Restricted, or an enabled policy with managed networking, on armv7/armhf, riscv64, ppc64le, s390x, or 32-bit x86 builds.","commonSituations":"Cross-compiling or running codex-rs on exotic SBCs and armhf distros; qemu-user CI runners on unsupported architectures; container base images for secondary arches.","solutions":["Run sandboxed workloads on x86_64 or aarch64 hosts, where the filter is supported","Disable network sandboxing on the affected host by choosing a sandbox configuration without a restricted or managed network policy","In a fork, add a cfg! branch mapping your architecture to a seccompiler TargetArch that supports it, and upstream the change","Fail fast at build time with a compile_error! guard so the panic never reaches production"],"exampleFix":"// before -- panics at runtime on armv7 when a network policy is applied\napply_permission_profile_to_current_thread(profile)?;\n\n// after -- reject unsupported architectures at compile time\n#[cfg(all(target_os = \"linux\", not(any(target_arch = \"x86_64\", target_arch = \"aarch64\"))))]\ncompile_error!(\"network seccomp filter requires x86_64 or aarch64\");","handlingStrategy":"validation","validationCode":"fn network_seccomp_supported() -> bool {\n    cfg!(any(target_arch = \"x86_64\", target_arch = \"aarch64\"))\n}\n\nif !network_seccomp_supported() {\n    return configure_without_network_seccomp();\n}","typeGuard":"fn seccomp_filter_target() -> Option<&'static str> {\n    if cfg!(target_arch = \"x86_64\") {\n        Some(\"x86_64\")\n    } else if cfg!(target_arch = \"aarch64\") {\n        Some(\"aarch64\")\n    } else {\n        None\n    }\n}","tryCatchPattern":"let outcome = std::panic::catch_unwind(|| {\n    apply_permission_profile_to_current_thread(profile)\n});\nif outcome.is_err() {\n    // unimplemented!() on this arch: fall back to a policy without network seccomp\n}","preventionTips":["Gate network-restricted sandboxing behind a target_arch build check","Restrict sandbox deployment images to x86_64/aarch64","Fail cross-compiles for unsupported arches early in build.rs"],"tags":["seccomp","architecture","linux-sandbox","panic","rust"],"backgroundTag":"unsupported-cpu-architecture","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}