Add preserved path policy primitive

Author: evawong-oai

codex-rs/linux-sandbox/src/bwrap.rs

@@ -256,6 +256,7 @@ fn create_filesystem_args(
         writable_roots.push(WritableRoot {
             root: AbsolutePathBuf::from_absolute_path("/")?,
             read_only_subpaths: Vec::new(),
+            preserved_path_names: Vec::new(),
         });
     }
     let mut unreadable_roots = file_system_sandbox_policy
@@ -1425,9 +1426,15 @@ mod tests {
                 "--bind".to_string(),
                 "/".to_string(),
                 "/".to_string(),
-                // Mask the default protected .codex subpath under that writable
-                // root. Because the root is `/` in this test, the carveout path
-                // appears as `/.codex`.
+                // Mask the default preserved path names under the writable root.
+                // Because the root is `/` in this test, these carveout paths
+                // appear directly below `/`.
+                "--ro-bind".to_string(),
+                "/dev/null".to_string(),
+                "/.git".to_string(),
+                "--ro-bind".to_string(),
+                "/dev/null".to_string(),
+                "/.agents".to_string(),
                 "--ro-bind".to_string(),
                 "/dev/null".to_string(),
                 "/.codex".to_string(),
@@ -1436,6 +1443,17 @@ mod tests {
                 "--bind".to_string(),
                 "/dev".to_string(),
                 "/dev".to_string(),
+                // Then mask the preserved names that would otherwise be
+                // creatable below the writable /dev bind.
+                "--ro-bind".to_string(),
+                "/dev/null".to_string(),
+                "/dev/.git".to_string(),
+                "--ro-bind".to_string(),
+                "/dev/null".to_string(),
+                "/dev/.agents".to_string(),
+                "--ro-bind".to_string(),
+                "/dev/null".to_string(),
+                "/dev/.codex".to_string(),
             ]
         );
     }