Skip to content

ubuntu-bubblewrap-apparmor.md

Latest commit

 

History

History
103 lines (75 loc) · 3.25 KB

ubuntu-bubblewrap-apparmor.md

File metadata and controls

103 lines (75 loc) · 3.25 KB
Raw

Codex Bubblewrap sandbox on Ubuntu 24.04+

Symptom

Codex displays:

Codex's Linux sandbox uses bubblewrap and needs access to create user namespaces.

Ubuntu 24.04 enables AppArmor mediation of unprivileged user namespaces by default. The following setting may therefore be 1 even when kernel.unprivileged_userns_clone is also 1:

sysctl kernel.apparmor_restrict_unprivileged_userns

Codex probes Bubblewrap with:

bwrap --unshare-user --unshare-net --ro-bind / / /bin/true

Without a suitable profile, Ubuntu rejects this probe, often with Failed RTM_NEWADDR: Operation not permitted.

Recommended solution for Codex Desktop

Do not disable kernel.apparmor_restrict_unprivileged_userns globally. Instead, from the repository root, install the narrowly scoped profile provided with the application. For an installed Debian package:

sudo install -m 0644 \
  "/opt/Codex Desktop/resources/apparmor/codex-desktop-linux" \
  /etc/apparmor.d/codex-desktop-linux
sudo apparmor_parser -r /etc/apparmor.d/codex-desktop-linux

From a source checkout, use packaging/apparmor/codex-desktop-linux as the first path instead.

The profile attaches only to /opt/Codex Desktop/codex-desktop, the root-owned executable installed by the Debian package. The App Server process and Bubblewrap inherit this profile. It grants only the AppArmor userns permission and keeps the global restriction enabled for every other program.

Quit the existing instance completely from the tray, then restart the application so it launches under the profile.

Verification

The global restriction must remain enabled:

cat /proc/sys/kernel/apparmor_restrict_unprivileged_userns
# 1

The direct, unconfined probe may still fail. The probe under the Codex Desktop profile must succeed:

aa-exec -p codex-desktop-linux -- \
  bwrap --unshare-user --unshare-net --ro-bind / / /bin/true
echo $?
# 0

Also verify that the profile is loaded:

sudo aa-status | grep codex-desktop-linux

Rollback

sudo apparmor_parser -R /etc/apparmor.d/codex-desktop-linux
sudo rm /etc/apparmor.d/codex-desktop-linux

This procedure never changes Ubuntu's global restriction.

Scope and security

  • This rule applies to the Debian application at /opt/Codex Desktop/codex-desktop.
  • It does not automatically cover direct use of a Codex CLI installed through NVM.
  • Applying a profile globally to /usr/bin/bwrap is discouraged because it would allow every caller to create user namespaces.
  • Disabling the sysctl globally increases the kernel attack surface and is not necessary here.

References