openai/codex · error

failed to verify Linux sandbox capabilities: {}

Error message

failed to verify Linux sandbox capabilities: {}

What it means

Error "failed to verify Linux sandbox capabilities: {}" thrown in openai/codex.

Source

Thrown at codex-rs/linux-sandbox/src/linux_run_main.rs:211

    // established the filesystem view.
    if apply_seccomp_then_exec {
        if let Err(err) = crate::fd_mount::verify_fd_mounts(&verify_fd_mounts) {
            panic!("failed to verify descriptor-backed bubblewrap mount: {err}");
        }

        let mut capability_header = [LINUX_CAPABILITY_VERSION_3, 0];
        let mut capability_sets = [[0_u32; 3]; 2];
        // SAFETY: capability ABI version 3 uses a [version, pid] header and
        // two [effective, permitted, inheritable] capability-set entries.
        let result = unsafe {
            libc::syscall(
                libc::SYS_capget,
                capability_header.as_mut_ptr(),
                capability_sets.as_mut_ptr(),
            )
        };
        if result < 0 {
            panic!(
                "failed to verify Linux sandbox capabilities: {}",
                std::io::Error::last_os_error()
            );
        }
        if capability_sets
            .into_iter()
            .any(|[effective, permitted, _]| effective != 0 || permitted != 0)
        {
            panic!("Linux sandbox retained effective or permitted capabilities");
        }

        if allow_network_for_proxy {
            let spec = proxy_route_spec
                .as_deref()
                .unwrap_or_else(|| panic!("managed proxy mode requires --proxy-route-spec"));
            if let Err(err) = activate_proxy_routes_in_netns(spec) {
                panic!("error activating Linux proxy routing bridge: {err}");
            }

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/linux-sandbox/src/linux_run_main.rs:211 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/a4c0c321a3806f16. Report an issue: GitHub.