Codex "Full access" permission means the agent can send tokens or private information to the internet.
Can we restrict internet access of codex somehow?
- only allow to READ from the internet (inbound access)?
- Deny outbound connectivity by default, with narrowly scoped exceptions enforced somewhere the agent cannot modify. Eg we should be able to authenticate in codex.
If we create multiple codex configuration profiles, the user could switch within those on just login and just logout.
Questions:
- should we edit
etc/hosts? can codex override it since it has sudo? Maybe with some permissions or lima tricks we can avoid that and maybe we should do the same for the Codex configuration.
- should we limit internet access in the buddy.yaml configuration?
allow GET requests only?
This is not a security boundary. Even an HTTP GET can transmit secrets in the hostname, path, query string, or headers. DNS requests can also carry data. Method restrictions are useful only as defense in depth.
/etc/hosts
Reject as a security mechanism. It controls some hostname resolution, not network access. Direct IPs, IPv6, alternate resolvers, DNS-over-HTTPS, and agent modification of the file all defeat it—especially with guest root.
AI disclamer
I used AI to do researches for this issue
Codex "Full access" permission means the agent can send tokens or private information to the internet.
Can we restrict internet access of codex somehow?
If we create multiple codex configuration profiles, the user could switch within those on just login and just logout.
Questions:
etc/hosts? can codex override it since it has sudo? Maybe with some permissions or lima tricks we can avoid that and maybe we should do the same for the Codex configuration.allow GET requests only?
This is not a security boundary. Even an HTTP GET can transmit secrets in the hostname, path, query string, or headers. DNS requests can also carry data. Method restrictions are useful only as defense in depth.
/etc/hosts
Reject as a security mechanism. It controls some hostname resolution, not network access. Direct IPs, IPv6, alternate resolvers, DNS-over-HTTPS, and agent modification of the file all defeat it—especially with guest root.
AI disclamer
I used AI to do researches for this issue