{"record":{"id":"73ef359afbc23362","repo":"openai/codex","slug":"deny-read-overrides-require-the-elevated-windows-s-73ef35","errorCode":null,"errorMessage":"deny-read overrides require the elevated Windows sandbox backend","messagePattern":"deny-read overrides require the elevated Windows sandbox backend","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"codex-rs/windows-sandbox-rs/src/unified_exec/backends/legacy.rs","lineNumber":339,"sourceCode":"    let common = prepare_legacy_spawn_context(\n        permission_profile,\n        workspace_roots,\n        codex_home,\n        cwd,\n        &mut env_map,\n        &command,\n        SpawnPrepOptions {\n            inherit_path: false,\n            add_git_safe_directory: false,\n        },\n    )?;\n    if !common.permissions.has_full_disk_read_access() {\n        anyhow::bail!(\"Restricted read-only access requires the elevated Windows sandbox backend\");\n    }\n    // WRITE_RESTRICTED tokens consult restricting SIDs only for writes, so this\n    // backend cannot make capability-SID deny-read ACLs authoritative.\n    if !additional_deny_read_paths.is_empty() {\n        anyhow::bail!(\"deny-read overrides require the elevated Windows sandbox backend\");\n    }\n    let additional_deny_write_paths = additional_deny_write_paths\n        .iter()\n        .map(AbsolutePathBuf::to_path_buf)\n        .collect::<Vec<_>>();\n    let capability_roots = legacy_session_capability_roots(\n        &common.permissions,\n        &common.current_dir,\n        &env_map,\n        codex_home,\n    );\n    let security = prepare_legacy_session_security(\n        common.uses_write_capabilities,\n        codex_home,\n        cwd,\n        capability_roots,\n    )?;\n    allow_null_device_for_workspace_write(common.uses_write_capabilities);","sourceCodeStart":321,"sourceCodeEnd":357,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/windows-sandbox-rs/src/unified_exec/backends/legacy.rs#L321-L357","documentation":"Error \"deny-read overrides require the elevated Windows sandbox backend\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/windows-sandbox-rs/src/unified_exec/backends/legacy.rs:339 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Enable the elevated Windows sandbox backend for this exec request, or remove the deny-read overrides."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}