{"record":{"id":"e6d9749877399a3f","repo":"openai/codex","slug":"linux-sandbox-retained-effective-or-permitted-capa","errorCode":null,"errorMessage":"Linux sandbox retained effective or permitted capabilities","messagePattern":"Linux sandbox retained effective or permitted capabilities","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"codex-rs/linux-sandbox/src/linux_run_main.rs","lineNumber":220,"sourceCode":"        // two [effective, permitted, inheritable] capability-set entries.\n        let result = unsafe {\n            libc::syscall(\n                libc::SYS_capget,\n                capability_header.as_mut_ptr(),\n                capability_sets.as_mut_ptr(),\n            )\n        };\n        if result < 0 {\n            panic!(\n                \"failed to verify Linux sandbox capabilities: {}\",\n                std::io::Error::last_os_error()\n            );\n        }\n        if capability_sets\n            .into_iter()\n            .any(|[effective, permitted, _]| effective != 0 || permitted != 0)\n        {\n            panic!(\"Linux sandbox retained effective or permitted capabilities\");\n        }\n\n        if allow_network_for_proxy {\n            let spec = proxy_route_spec\n                .as_deref()\n                .unwrap_or_else(|| panic!(\"managed proxy mode requires --proxy-route-spec\"));\n            if let Err(err) = activate_proxy_routes_in_netns(spec) {\n                panic!(\"error activating Linux proxy routing bridge: {err}\");\n            }\n        }\n        let proxy_routing_active = allow_network_for_proxy;\n        if let Err(e) = apply_permission_profile_to_current_thread(\n            &permission_profile,\n            &sandbox_policy_cwd,\n            /*apply_landlock_fs*/ false,\n            allow_network_for_proxy,\n            proxy_routing_active,\n        ) {","sourceCodeStart":202,"sourceCodeEnd":238,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/linux-sandbox/src/linux_run_main.rs#L202-L238","documentation":"Error \"Linux sandbox retained effective or permitted capabilities\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/linux-sandbox/src/linux_run_main.rs:220 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}