[zachsplat]

Fixes #188.

On Ubuntu 26.04 runners, drop-sudo stops before Codex starts:

Error: Could not restrict access to /run/dbus/system_bus_socket.

For example AgentMeter/agentmeter-action run 40688459476 (image ubuntu-26.04 20261012.163.1, 28 October): https://github.com/AgentMeter/agentmeter-action/actions/runs/40688459476/job/122816823703. ubuntu-latest moves to 26.04 by 19 November (actions/runner-images#14748), and the projects linked from #188 have been pinning their jobs to ubuntu-24.04 to get past it.

The ACL is applied; the check is what fails. As the runner-images team found in actions/runner-images#15004, /usr/bin/test on 26.04 is the uutils one (rust-coreutils 0.10.0), and its -w reads only the mode bits (in my strace it makes a single statx call), so after setfacl -m u:runner:--- it still says the socket is writable. This change runs the same check as /bin/sh -c 'test -w "$1"' sh /proc/self/fd/3 instead. The dash builtin calls faccessat2(..., W_OK, AT_EACCESS), which applies the ACL. setpriv still sets the same UID and groups, /proc/self/fd/3 is still the last argument, and a denied check still exits 1 with empty stderr, so the rest of isSocketWritable and its unit test in test/dropSudoSocketAcl.test.mjs need no change. /bin/sh is what the launcher script already uses.

test/dropSudo.test.mjs made the same test -w checks in its setup and its final assertions, so on 26.04 it fails before the action even runs. A small testWritable() helper gives those checks the same shell form. dist/main.js is rebuilt with the build script's esbuild command (esbuild 0.23.0 from the lockfile); rebuilding 13e9c17 that way gives a file identical to the committed one, so the dist diff is only this change and its inline source map.

What I ran, all in throwaway containers from the official ubuntu:24.04 and ubuntu:26.04 images with no network at run time:

• A root-owned 0666 socket with setfacl -n -m u:runner:---, the socket opened O_PATH on fd 3, then setpriv to the runner UID: /usr/bin/test -w /proc/self/fd/3 exits 0 on 26.04 and 1 on 24.04; the sh -c form exits 1 on both; a real connect() gets EACCES on both. Without the ACL every form exits 0.
• This repo's tsc --noEmit, the esbuild build and node --test test/*.test.mjs at 13e9c17, as a runner-like user (passwordless sudo, in the docker group, a root-owned /var/run/docker.sock):
  • 24.04: 182 of 182 pass, before and after this change.
  • 26.04 with only the test helper change: the drop-sudo subtests fail with Could not restrict access to /run/codex-action-...sock, the same error as drop-sudo fails on Ubuntu 26.04 #188. With this whole change that error is gone.

I have not run the action itself on a GitHub-hosted runner.

On 26.04, 12 drop-sudo subtests still fail after this change, for a separate reason this PR does not touch: sudo there is sudo-rs, which ignores -E (sudo: preserving the entire environment is not supported, '-E' is ignored, which also appears in the AgentMeter log above), so the Codex stub never sees CODEX_CAPTURE_PATH. On a runner that means the step's environment, for example a custom CODEX_HOME, does not reach Codex; HOME, PATH, NODE_OPTIONS and TMPDIR still arrive because the launcher passes them as arguments.

Would you like me to handle the -E part in this PR too, or would you rather do that one separately?

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[zachsplat]

I have read the CLA Document and I hereby sign the CLA

[ww-oai]

Thanks for the PR @zachsplat but we'll likely go with #192 because the Node API semantics are easier for us to consistently assert.