{"record":{"id":"2128a08448aa3ebc","repo":"openai/codex","slug":"failed-to-read-synthetic-bubblewrap-mount-marker","errorCode":null,"errorMessage":"failed to read synthetic bubblewrap mount marker {}: {err}","messagePattern":"failed to read synthetic bubblewrap mount marker (.+?): (.+?)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"codex-rs/linux-sandbox/src/linux_run_main.rs","lineNumber":1038,"sourceCode":"            })\n            .collect()\n    })\n}\n\nfn synthetic_mount_marker_contents(target: &crate::bwrap::SyntheticMountTarget) -> &'static [u8] {\n    if target.preserves_pre_existing_path() {\n        SYNTHETIC_MOUNT_MARKER_EXISTING\n    } else {\n        SYNTHETIC_MOUNT_MARKER_SYNTHETIC\n    }\n}\n\nfn synthetic_mount_marker_dir_has_active_synthetic_owner(marker_dir: &Path) -> bool {\n    synthetic_mount_marker_dir_has_active_process_matching(marker_dir, |path| {\n        match fs::read(path) {\n            Ok(contents) => contents == SYNTHETIC_MOUNT_MARKER_SYNTHETIC,\n            Err(err) if err.kind() == std::io::ErrorKind::NotFound => false,\n            Err(err) => panic!(\n                \"failed to read synthetic bubblewrap mount marker {}: {err}\",\n                path.display()\n            ),\n        }\n    })\n}\n\nfn synthetic_mount_marker_dir_has_active_process(marker_dir: &Path) -> bool {\n    synthetic_mount_marker_dir_has_active_process_matching(marker_dir, |_| true)\n}\n\nfn synthetic_mount_marker_dir_has_active_process_matching(\n    marker_dir: &Path,\n    matches_marker: impl Fn(&Path) -> bool,\n) -> bool {\n    let entries = match fs::read_dir(marker_dir) {\n        Ok(entries) => entries,\n        Err(err) if err.kind() == std::io::ErrorKind::NotFound => return false,","sourceCodeStart":1020,"sourceCodeEnd":1056,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/linux-sandbox/src/linux_run_main.rs#L1020-L1056","documentation":"When a synthetic target preserves a pre-existing path, registration checks whether another live process already owns a synthetic copy by reading every live PID's marker file (synthetic_mount_marker_dir_has_active_synthetic_owner, linux_run_main.rs:1033). NotFound maps to no-owner; any other read error panics: permission-denied on the marker file (ownership or permission drift inside the registry), EACCES on traversal, or genuine I/O errors from failing storage.","triggerScenarios":"Registering a preserves-pre-existing-path target (an existing empty file or dir in the workspace) while the registry contains a marker file unreadable by the current effective uid — chmod or chown drift, state restored from backups, privilege-drop mixing — or storage returning EIO.","commonSituations":"Permission sweeps or manual chmod inside /tmp/codex-bwrap-synthetic-mount-targets-*; uid changes between sessions; backup or restore tooling dropping permissions; failing disks.","solutions":["Inspect the exact marker path in the panic with ls -l and restore access: chown $(id -u) plus chmod u+rw.","With all codex processes stopped, reset the registry: rm -rf ${TMPDIR:-/tmp}/codex-bwrap-synthetic-mount-targets-$(id -u).","Check dmesg for I/O errors if the permissions look correct.","Report upstream if a freshly created registry reproduces the failure."],"exampleFix":"# before: unreadable marker file blocks registration\nls -l /tmp/codex-bwrap-synthetic-mount-targets-1000/0123abcd4567/1234\n# -r-------- 1 root root ...\n\n# after: restore ownership and permissions, or reset the registry\nchown -R $(id -u) /tmp/codex-bwrap-synthetic-mount-targets-$(id -u)\nchmod -R u+rwX /tmp/codex-bwrap-synthetic-mount-targets-$(id -u)","handlingStrategy":"validation","validationCode":"fn registry_files_readable() -> Result<(), std::path::PathBuf> {\n    let root = std::env::temp_dir().join(format!(\n        \"codex-bwrap-synthetic-mount-targets-{}\",\n        unsafe { libc::geteuid() }\n    ));\n    for dir in std::fs::read_dir(&root).into_iter().flatten().flatten() {\n        for entry in std::fs::read_dir(dir.path()).into_iter().flatten().flatten() {\n            if std::fs::File::open(entry.path()).is_err() {\n                return Err(entry.path());\n            }\n        }\n    }\n    Ok(())\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat the registry root as private launcher state; never chown or chmod into it.","Run all sessions sharing one registry under the same effective uid.","Exclude the registry from backup, restore, and permission-audit tooling."],"tags":["sandbox","registry","marker-file","permissions","read-failure","eio"],"backgroundTag":"permission-denied-reading-file","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}