openai/codex · error

permission profiles requiring direct runtime enforcement…

Error message

permission profiles requiring direct runtime enforcement are incompatible with --use-legacy-landlock

What it means

Legacy Landlock mode was selected, but the resolved permission policy requires direct runtime enforcement that legacy mode cannot provide. This guard in ensure_legacy_landlock_mode_supports_policy fires when the filesystem policy needs_direct_runtime_enforcement given the network policy — i.e. split-mode rules that only the bwrap-based stages can enforce — so running with --use-legacy-landlock would silently under-sandbox.

Solutions

1. Drop --use-legacy-landlock so the bwrap-based enforcement path is used
2. Choose a permission profile whose filesystem policy is compatible with legacy Landlock
3. Update the kernel/landlock ABI so the non-legacy path is available

When it happens

Trigger: Thrown at codex-rs/linux-sandbox/src/linux_run_main.rs:391 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/99e99131ca35f1f4. Report an issue: GitHub.

Appendix: source

Thrown at codex-rs/linux-sandbox/src/linux_run_main.rs:391

}

fn ensure_inner_stage_mode_is_valid(apply_seccomp_then_exec: bool, use_legacy_landlock: bool) {
    if apply_seccomp_then_exec && use_legacy_landlock {
        panic!("--apply-seccomp-then-exec is incompatible with --use-legacy-landlock");
    }
}

fn ensure_legacy_landlock_mode_supports_policy(
    use_legacy_landlock: bool,
    file_system_sandbox_policy: &FileSystemSandboxPolicy,
    network_sandbox_policy: NetworkSandboxPolicy,
    sandbox_policy_cwd: &Path,
) {
    if use_legacy_landlock
        && file_system_sandbox_policy
            .needs_direct_runtime_enforcement(network_sandbox_policy, sandbox_policy_cwd)
    {
        panic!(
            "permission profiles requiring direct runtime enforcement are incompatible with --use-legacy-landlock"
        );
    }
}

fn run_bwrap_with_proc_fallback(
    sandbox_policy_cwd: &Path,
    command_cwd: Option<&Path>,
    file_system_sandbox_policy: &FileSystemSandboxPolicy,
    network_sandbox_policy: NetworkSandboxPolicy,
    inner: Vec<String>,
    mount_proc: bool,
    allow_network_for_proxy: bool,
) -> ! {
    let network_mode = bwrap_network_mode(network_sandbox_policy, allow_network_for_proxy);
    let mut mount_proc = mount_proc;
    let command_cwd = command_cwd.unwrap_or(sandbox_policy_cwd);

View on GitHub (pinned to 339751715c)