codex - 💡(How to fix) Fix Codex calls sudo and uses residual no-password time to run commands with root privilege [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openai/codex#19827Fetched 2026-04-28 06:36:22
View on GitHub
Comments
0
Participants
1
Timeline
4
Reactions
0
Participants
Timeline (top)
labeled ×3unlabeled ×1

Code Example

────────────────────────────────────────────────────────────────────────────────────────

The local tree still has Qt 5 dev-qt/qtnetwork and dev-qt/qtxml available. The clean
  fix is to reinstall those Qt 5 providers as real packages, not keep rebuilding WPS;
  after that Portage can drop the old preserved copies once nothing resolves to them.

 You approved codex to run sudo emerge --oneshot dev-qt/qtnetwork:5 dev-qt/qtxml:5 this
  time

Waited for background terminal

Ran sudo emerge --oneshot dev-qt/qtnetwork:5 dev-qt/qtxml:5
Calculating dependencies  ... done!
    Dependency resolution took 1.97 s (backtrack: 0/20).
     +403 lines (ctrl + t to view transcript)
    qtbase-everywhere-src-5.15.18_build/config.tests/x86_simd && MAKEFLAGS= /usr/bin/
    gmake clean && MAKEFLAGS= /usr/bin/gmake

The install is underway. It is building dev-qt/qtnetwork-5.15.18 first, then dev-qt/
  qtxml-5.15.18; this is a source build, so it may take a few minutes.

 Waited for background terminal

• qtnetwork has moved past configuration and is compiling the library/plugins now. After
  it installs, qtxml should be much smaller.

 Waited for background terminal

Ran sudo emerge --oneshot dev-qt/qtnetwork:5 dev-qt/qtxml:5
Calculating dependencies  ... done!
    Dependency resolution took 1.97 s (backtrack: 0/20).
     +2599 lines (ctrl + t to view transcript)

     * GNU info directory index is up-to-date.

 Waited for background terminal

Worked for 1m 29s ────────────────────────────────────────────────────────────────────

---

~ sudo echo 1
1
~ codex
╭────────────────────────────────────────────╮
>_ OpenAI Codex (v0.125.0)│                                            │
│ model:     gpt-5.5 high   /model to change │
│ directory: ~╰────────────────────────────────────────────╯

  Tip: New Use /fast to enable our fastest inference with increased plan usage.


 Run 'sudo echo 1'


You approved codex to run sudo echo 1 this time

Ran sudo echo 1
1

────────────────────────────────────────────────────────────────────────────────────────

• sudo echo 1 printed:

  1
RAW_BUFFERClick to expand / collapse

What version of Codex CLI is running?

codex-cli 0.125.0

What subscription do you have?

Plus

Which model were you using?

gpt-5.5

What platform is your computer?

Linux 7.0.1-gentoo x86_64 AMD Ryzen 7 8845H w/ Radeon 780M Graphics

What terminal emulator and version are you using (if applicable)?

alacritty

What issue are you seeing?

Though this is the behavior I want, I wonder is there a more direct approach to temporarily grant sudo privilege to codex? Or is this considered a security bug?

────────────────────────────────────────────────────────────────────────────────────────

• The local tree still has Qt 5 dev-qt/qtnetwork and dev-qt/qtxml available. The clean
  fix is to reinstall those Qt 5 providers as real packages, not keep rebuilding WPS;
  after that Portage can drop the old preserved copies once nothing resolves to them.

✔ You approved codex to run sudo emerge --oneshot dev-qt/qtnetwork:5 dev-qt/qtxml:5 this
  time

• Waited for background terminal

• Ran sudo emerge --oneshot dev-qt/qtnetwork:5 dev-qt/qtxml:5
  └ Calculating dependencies  ... done!
    Dependency resolution took 1.97 s (backtrack: 0/20).
    … +403 lines (ctrl + t to view transcript)
    qtbase-everywhere-src-5.15.18_build/config.tests/x86_simd && MAKEFLAGS= /usr/bin/
    gmake clean && MAKEFLAGS= /usr/bin/gmake

• The install is underway. It is building dev-qt/qtnetwork-5.15.18 first, then dev-qt/
  qtxml-5.15.18; this is a source build, so it may take a few minutes.

• Waited for background terminal

• qtnetwork has moved past configuration and is compiling the library/plugins now. After
  it installs, qtxml should be much smaller.

• Waited for background terminal

• Ran sudo emerge --oneshot dev-qt/qtnetwork:5 dev-qt/qtxml:5
  └ Calculating dependencies  ... done!
    Dependency resolution took 1.97 s (backtrack: 0/20).
    … +2599 lines (ctrl + t to view transcript)

     * GNU info directory index is up-to-date.

• Waited for background terminal

─ Worked for 1m 29s ────────────────────────────────────────────────────────────────────

What steps can reproduce the bug?

➜  ~ sudo echo 1
1
➜  ~ codex
╭────────────────────────────────────────────╮
│ >_ OpenAI Codex (v0.125.0)                 │
│                                            │
│ model:     gpt-5.5 high   /model to change │
│ directory: ~                               │
╰────────────────────────────────────────────╯

  Tip: New Use /fast to enable our fastest inference with increased plan usage.


› Run 'sudo echo 1'


✔ You approved codex to run sudo echo 1 this time

• Ran sudo echo 1
  └ 1

────────────────────────────────────────────────────────────────────────────────────────

• sudo echo 1 printed:

  1

What is the expected behavior?

Either: there is a designed way to grant root privileges to codex

Or: codex shouldn't make use of residual no-password time for sudo

Additional information

No response

extent analysis

TL;DR

The user is looking for a more direct approach to temporarily grant sudo privilege to Codex, and it seems that Codex is currently using residual no-password time for sudo.

Guidance

  • The issue seems to be related to how Codex handles sudo privileges, and the user is looking for a more direct way to grant these privileges.
  • To verify the current behavior, the user can try running sudo echo 1 through Codex and see if it still uses residual no-password time for sudo.
  • The user may need to configure Codex to properly handle sudo privileges, potentially by setting up a more explicit way to grant these privileges.
  • It's unclear if this is a security bug or an intended behavior, and further investigation may be needed to determine the best course of action.

Notes

The issue lacks information on how Codex is configured to handle sudo privileges, which makes it difficult to provide a more specific solution.

Recommendation

Apply workaround: The user may need to manually configure Codex to handle sudo privileges in a more explicit way, rather than relying on residual no-password time.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

codex - 💡(How to fix) Fix Codex calls sudo and uses residual no-password time to run commands with root privilege [1 participants]