Linux sandbox retained effective or permitted capabilities

Error message

Linux sandbox retained effective or permitted capabilities

What it means

Error "Linux sandbox retained effective or permitted capabilities" thrown in openai/codex.

Source

Thrown at codex-rs/linux-sandbox/src/linux_run_main.rs:220

        // two [effective, permitted, inheritable] capability-set entries.
        let result = unsafe {
            libc::syscall(
                libc::SYS_capget,
                capability_header.as_mut_ptr(),
                capability_sets.as_mut_ptr(),
            )
        };
        if result < 0 {
            panic!(
                "failed to verify Linux sandbox capabilities: {}",
                std::io::Error::last_os_error()
            );
        }
        if capability_sets
            .into_iter()
            .any(|[effective, permitted, _]| effective != 0 || permitted != 0)
        {
            panic!("Linux sandbox retained effective or permitted capabilities");
        }

        if allow_network_for_proxy {
            let spec = proxy_route_spec
                .as_deref()
                .unwrap_or_else(|| panic!("managed proxy mode requires --proxy-route-spec"));
            if let Err(err) = activate_proxy_routes_in_netns(spec) {
                panic!("error activating Linux proxy routing bridge: {err}");
            }
        }
        let proxy_routing_active = allow_network_for_proxy;
        if let Err(e) = apply_permission_profile_to_current_thread(
            &permission_profile,
            &sandbox_policy_cwd,
            /*apply_landlock_fs*/ false,
            allow_network_for_proxy,
            proxy_routing_active,
        ) {

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/linux-sandbox/src/linux_run_main.rs:220 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/e6d9749877399a3f. Report an issue: GitHub.