openai/codex · error

convert deny capability SID failed

Error message

convert deny capability SID failed

What it means

Error "convert deny capability SID failed" thrown in openai/codex.

Source

Thrown at codex-rs/windows-sandbox-rs/src/bin/setup_main/win.rs:981

        // during setup, the sandbox could otherwise create it later under a writable parent and
        // bypass the carveout. Materialize missing carveouts as directories so the deny-write ACL
        // is present before the command starts. Legacy protected children are filtered before
        // payload creation, so this should not create sentinel directories in a workspace.
        if !path.exists() {
            std::fs::create_dir_all(path)
                .with_context(|| format!("failed to create deny-write path {}", path.display()))?;
        }

        let deny_sid_strs = workspace_write_cap_sids_for_path(
            &payload.codex_home,
            &payload.command_cwd,
            &payload.write_roots,
            path,
        )?;
        for deny_sid_str in deny_sid_strs {
            let deny_psid = unsafe {
                convert_string_sid_to_sid(&deny_sid_str)
                    .ok_or_else(|| anyhow::anyhow!("convert deny capability SID failed"))?
            };

            match unsafe { add_deny_write_ace(path, deny_psid) } {
                Ok(true) => {
                    log_line(
                        log,
                        &format!("applied deny ACE to protect {}", path.display()),
                    )?;
                }
                Ok(false) => {}
                Err(err) => {
                    refresh_errors.push(format!("deny ACE failed on {}: {err}", path.display()));
                    log_line(
                        log,
                        &format!("deny ACE failed on {}: {err}", path.display()),
                    )?;
                }
            }

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/windows-sandbox-rs/src/bin/setup_main/win.rs:981 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/5c9a1b95957ba70f. Report an issue: GitHub.