#include <tunables/global>

profile codex_bridge flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>
  #include <abstractions/nameservice>

  # The trusted S6, Bridge, and Codex parent need normal container lifecycle
  # operations and HTTPS/DNS egress. No host networking or extra Docker
  # capability is requested by config.yaml.
  capability chown,
  capability dac_override,
  capability fowner,
  capability fsetid,
  capability kill,
  capability setgid,
  capability setuid,
  capability setpcap,
  capability net_bind_service,
  capability sys_chroot,

  signal (send,receive),

  network inet stream,
  network inet dgram,
  network inet6 stream,
  network inet6 dgram,
  network netlink raw,
  network netlink dgram,

  / r,
  /init rix,
  /bin/** rix,
  /sbin/** rix,
  /usr/bin/** rix,
  /usr/sbin/** rix,
  /usr/lib/** mr,
  /usr/lib/bashio/** rix,
  /lib/** mr,
  /package/** rix,
  /command/** rix,

  /usr/local/bin/ r,
  /usr/local/bin/codex-app-entrypoint rix,
  /usr/local/bin/python* rix,
  /usr/local/bin/sandbox-self-test rix,
  /usr/local/bin/codex-ha rix,
  /usr/local/bin/codex mr,
  /usr/local/bin/codex rix,
  /usr/local/bin/codex-code-mode-host mr,
  /usr/local/bin/codex-code-mode-host rix,
  /usr/local/bin/bwrap mr,
  /opt/ r,
  /opt/codex-browser/{,bin/} r,
  /opt/codex-browser/bin/bwrap mr,
  /opt/codex-browser/bin/bwrap Cx -> browser_bwrap,
  /opt/codex-stdio/bin/bwrap mr,
  /opt/codex-stdio/bin/bwrap Cx -> stdio_bwrap,
  /opt/codex-stdio/packages/{,**} r,
  /opt/codex/ r,
  /opt/codex/bin/ r,
  /opt/codex/bin/bwrap mr,
  /opt/codex/bin/bwrap Cx -> codex_bwrap,
  /usr/local/lib/** mr,
  /usr/local/libexec/codex-bridge/ r,
  /usr/local/libexec/codex-bridge/** rix,
  /usr/local/share/codex-bridge/** r,

  /etc/** r,
  /proc/ r,
  /proc/** r,
  /sys/ r,
  /sys/** r,
  /dev/ r,
  /dev/** rw,

  /run/{,**} rwkix,
  /run/codex-bridge/ rw,
  /run/codex-bridge/** rwk,
  /tmp/ rw,
  /tmp/** rwk,
  /data/ rw,
  /data/** rwk,
  /config/ r,
  /config/.sandbox-self-test-* rw,
  /config/workspaces/ rw,
  /config/workspaces/** rwk,

  # Bubblewrap alone receives the namespace/mount setup permissions. HA OS
  # AppArmor 3.x cannot resolve a nested grandchild transition, so the fixed
  # inner Codex launcher inherits this child profile. Startup attestation must
  # then prove that the final model-command process has dropped every usable
  # capability and that its seccomp/namespace/mount/network boundary is live.
  profile codex_bwrap flags=(attach_disconnected,mediate_deleted) {
    #include <abstractions/base>

    signal (send,receive),

    capability chown,
    capability dac_override,
    capability fowner,
    capability setgid,
    capability setuid,
    capability setpcap,
    capability sys_admin,
    capability sys_chroot,
    capability net_admin,
    capability mknod,

    mount,
    umount,
    pivot_root,

    # Required only while Bubblewrap configures loopback in its fresh network
    # namespace. No inet/inet6 permission is granted to this profile, and the
    # final command must also prove that its locked seccomp filter rejects
    # IPv4, IPv6, and netlink socket creation.
    network netlink raw,
    network netlink dgram,

    / r,
    /bin/ r,
    /bin/** rix,
    /sbin/ r,
    /sbin/** rix,
    /usr/ r,
    /usr/bin/** rix,
    /usr/sbin/** rix,
    /usr/lib/** mr,
    /lib/ r,
    /lib/** mr,
    /usr/local/ r,
    /usr/local/bin/ r,
    /usr/local/bin/bwrap mr,
    /usr/local/bin/bwrap ix,
    /usr/local/bin/codex mr,
    /usr/local/bin/codex ix,
    /usr/local/bin/python* rix,
    /usr/local/lib/** mr,
    /usr/local/libexec/codex-bridge/ r,
    /usr/local/libexec/codex-bridge/sandbox_probe.py r,
    /opt/codex/bin/bwrap r,

    /etc/ r,
    /etc/** r,
    /proc/ rw,
    /proc/** rw,
    /sys/ r,
    /sys/** r,
    /dev/ rw,
    /dev/** rw,
    /newroot/{,**} rwkl,
    /tmp/ rw,
    /tmp/** rwk,
    /config/ r,
    /config/workspaces/ rw,
    /config/workspaces/** rwk,
    /config/workspaces/** mrix,

    deny /data/{,**} rwklmx,
    deny /run/codex-bridge/{,**} rwklmx,
  }
  # Separate browser boundary. Supervisor changes the outer profile name,
  # so the signal peer matches only this child suffix inside the PID namespace.
  profile browser_bwrap flags=(attach_disconnected,mediate_deleted) {
    #include <abstractions/base>

    signal (send) peer=**//browser_bwrap,
    signal (receive),

    capability chown,
    capability dac_override,
    capability fowner,
    capability setgid,
    capability setuid,
    capability setpcap,
    capability sys_admin,
    capability sys_chroot,
    capability net_admin,
    capability mknod,

    mount,
    umount,
    pivot_root,

    # Bubblewrap configures loopback before dropping capabilities. Only TCP
    # loopback reaches the private Unix proxy after the namespace is created;
    # the locked seccomp filter also denies UDP and raw IP socket creation.
    network inet stream,
    network inet6 stream,
    deny network inet dgram,
    deny network inet6 dgram,
    network netlink raw,
    network netlink dgram,

    / r,
    /bin/ r,
    /bin/** rix,
    /sbin/ r,
    /sbin/** rix,
    /usr/ r,
    /usr/share/ r,
    /usr/share/fonts/{,**} r,
    /usr/share/fontconfig/{,**} r,
    /usr/bin/** rix,
    /usr/sbin/** rix,
    /usr/lib/** mr,
    /usr/lib/chromium/** rix,
    /lib/ r,
    /lib/** mr,
    /usr/local/ r,
    /usr/local/bin/ r,
    /usr/local/bin/bwrap mr,
    /usr/local/bin/bwrap ix,
    /usr/local/bin/python* rix,
    /usr/local/lib/** mr,
    /usr/local/libexec/codex-bridge/ r,
    /usr/local/libexec/codex-bridge/browser_sandbox.py r,
    /usr/local/libexec/codex-bridge/browser_probe.py r,
    /run/browser/ r,
    /run/browser/egress.sock rw,
    /opt/codex-browser/bin/bwrap mr,

    /etc/ r,
    /etc/** r,
    /proc/ r,
    /proc/** r,
    owner /proc/*/{uid_map,gid_map,setgroups} rw,
    /sys/ r,
    /sys/** r,
    /dev/ rw,
    /dev/** rw,
    /newroot/{,**} rwkl,
    /tmp/ rw,
    /tmp/** rwk,
    deny /config/{,**} rwklmx,

    deny /proc/**/{root,cwd,mem,environ,map_files}{,/**} rwklmx,
    deny /proc/**/{fd,fdinfo}/* rwklmx,
    deny /data/{,**} rwklmx,
    deny /run/codex-bridge/{,**} rwklmx,
  }
  # Separate, no-network boundary for approved pure-Python stdio MCP workers.
  # The final Python process inherits this profile after Bubblewrap drops all
  # capabilities. Boot attestation must inspect that process before activation.
  profile stdio_bwrap flags=(attach_disconnected,mediate_deleted) {
    #include <abstractions/base>

    signal (send) peer=**//stdio_bwrap,
    signal (receive),

    capability chown,
    capability dac_override,
    capability fowner,
    capability setgid,
    capability setuid,
    capability setpcap,
    capability sys_admin,
    capability sys_chroot,
    capability net_admin,
    capability mknod,

    mount,
    umount,
    pivot_root,

    # Bubblewrap may configure its new loopback device before the worker's
    # seccomp filter starts. No inet or Unix socket permission is granted.
    network netlink raw,
    network netlink dgram,

    / r,
    /bin/ r,
    /bin/** rix,
    /sbin/ r,
    /sbin/** rix,
    /usr/ r,
    /usr/bin/** rix,
    /usr/lib/** mr,
    /usr/share/ r,
    /usr/share/zoneinfo/{,**} r,
    /lib/ r,
    /lib/** mr,
    /usr/local/ r,
    /usr/local/bin/ r,
    /usr/local/bin/python* rix,
    /usr/local/lib/** mr,
    /usr/local/libexec/codex-bridge/ r,
    /usr/local/libexec/codex-bridge/stdio_sandbox.py r,
    /usr/local/libexec/codex-bridge/stdio_probe.py r,
    /opt/codex-stdio/ r,
    /opt/codex-stdio/bin/ r,
    /opt/codex-stdio/bin/bwrap mr,
    /opt/codex-stdio/bin/bwrap ix,
    /opt/codex-stdio/packages/ r,
    /opt/codex-stdio/packages/** mr,

    /etc/ r,
    /proc/ r,
    /proc/** r,
    owner /proc/*/{uid_map,gid_map,setgroups} rw,
    /sys/ r,
    /sys/** r,
    /dev/ rw,
    /dev/** rw,
    /newroot/{,**} rwkl,
    /tmp/ rw,
    /tmp/** rwk,
    /package/ r,
    /package/** mr,

    deny /proc/**/{root,cwd,mem,environ,map_files}{,/**} rwklmx,
    deny /proc/**/{fd,fdinfo}/* rwklmx,
    deny /proc/[0-9]*/{cmdline,maps,smaps,smaps_rollup} rwklmx,
    deny /data/{,**} rwklmx,
    deny /config/{,**} rwklmx,
    deny /run/codex-bridge/{,**} rwklmx,
  }
}