{"record":{"id":"eb187a3331130737","repo":"openai/codex","slug":"failed-to-create-protected-create-marker-directory","errorCode":null,"errorMessage":"failed to create protected create marker directory {}: {err}","messagePattern":"failed to create protected create marker directory (.+?): (.+?)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"codex-rs/linux-sandbox/src/linux_run_main.rs","lineNumber":1003,"sourceCode":"                    target,\n                    marker_file,\n                    marker_dir,\n                }\n            })\n            .collect()\n    })\n}\n\nfn register_protected_create_targets(\n    targets: &[crate::bwrap::ProtectedCreateTarget],\n) -> Vec<ProtectedCreateTargetRegistration> {\n    with_synthetic_mount_registry_lock(|| {\n        targets\n            .iter()\n            .map(|target| {\n                let marker_dir = synthetic_mount_marker_dir(target.path());\n                fs::create_dir_all(&marker_dir).unwrap_or_else(|err| {\n                    panic!(\n                        \"failed to create protected create marker directory {}: {err}\",\n                        marker_dir.display()\n                    )\n                });\n                let marker_file = marker_dir.join(std::process::id().to_string());\n                fs::write(&marker_file, PROTECTED_CREATE_MARKER).unwrap_or_else(|err| {\n                    panic!(\n                        \"failed to register protected create target {}: {err}\",\n                        target.path().display()\n                    )\n                });\n                ProtectedCreateTargetRegistration {\n                    target: target.clone(),\n                    marker_file,\n                    marker_dir,\n                }\n            })\n            .collect()","sourceCodeStart":985,"sourceCodeEnd":1021,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/linux-sandbox/src/linux_run_main.rs#L985-L1021","documentation":"register_protected_create_targets (linux_run_main.rs:994) uses the same per-uid hash registry for paths the sandbox must never let the workload create (protected workspace metadata): it creates the marker directory under the flock before forking. create_dir_all panics when ${TMPDIR}/codex-bwrap-synthetic-mount-targets-<euid> is not creatable: unwritable or read-only TMPDIR, ENOSPC, or a non-directory ancestor.","triggerScenarios":"Any sandboxed run that carries protected_create_targets (also the only case that creates the exec-start pipe, linux_run_main.rs:579) while the temp root is read-only, permission-denied, or full.","commonSituations":"Read-only /tmp hardening; TMPDIR misconfiguration in service units; PrivateTmp with restrictive mount flags; tmpfs exhaustion.","solutions":["Set TMPDIR to a writable directory with free space and rerun.","Fix permissions on the deepest existing ancestor of the path printed in the panic.","Enlarge or free the filesystem backing TMPDIR.","Reset the stale registry root with all codex processes stopped."],"exampleFix":"# before: TMPDIR inside a read-only mount\nTMPDIR=/srv/locked-tmp codex ...\n\n# after: writable temp root\nTMPDIR=/var/tmp/codex codex ...","handlingStrategy":"validation","validationCode":"fn temp_registry_writable() -> std::io::Result<()> {\n    let root = std::env::temp_dir().canonicalize()?;\n    let probe = root.join(format!(\"codex-probe-{}\", std::process::id()));\n    std::fs::create_dir_all(&probe)?;\n    std::fs::write(probe.join(\"p\"), b\"x\")?;\n    std::fs::remove_dir_all(&probe)?;\n    Ok(())\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check TMPDIR writability in service startup probes before the first sandboxed run.","Keep the registry filesystem writable for the effective uid.","Do not manually lock down or chmod the registry root."],"tags":["sandbox","protected-create","registry","tmpdir","permissions","enospc"],"backgroundTag":"tmp-dir-not-writable","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}