codex-rs/cli/src/doctor/security.rs

#[cfg(any(target_os = "macos", target_os = "windows"))]
use std::ffi::OsStr;
#[cfg(target_os = "windows")]
use std::path::PathBuf;
#[cfg(any(target_os = "macos", target_os = "windows"))]
use std::process::Output;
#[cfg(any(target_os = "macos", target_os = "windows"))]
use std::process::Stdio;
#[cfg(any(target_os = "macos", target_os = "windows"))]
use std::time::Duration;

#[cfg(any(target_os = "macos", target_os = "windows"))]
use tokio::process::Command;
#[cfg(any(target_os = "macos", target_os = "windows"))]
use tokio::time::timeout;

use super::CheckStatus;
use super::DoctorCheck;
use super::DoctorIssue;

#[cfg(any(target_os = "macos", target_os = "windows"))]
const PRODUCT_QUERY_TIMEOUT: Duration = Duration::from_secs(5);
#[cfg(any(target_os = "macos", target_os = "windows"))]
const MAX_PRODUCT_OUTPUT_BYTES: usize = 64 * 1024;

pub(super) enum EndpointInspection {
    Complete(Vec<&'static str>),
    #[cfg(any(target_os = "windows", test))]
    Partial(Vec<&'static str>),
    #[cfg(any(target_os = "macos", target_os = "windows", test))]
    Unavailable,
}

pub(super) async fn check() -> DoctorCheck {
    endpoint_check(endpoint_products().await)
}

pub(super) fn endpoint_check(inspection: EndpointInspection) -> DoctorCheck {
    let (products, visibility_incomplete) = match inspection {
        EndpointInspection::Complete(products) => (products, false),
        #[cfg(any(target_os = "windows", test))]
        EndpointInspection::Partial(products) => (products, true),
        #[cfg(any(target_os = "macos", target_os = "windows", test))]
        EndpointInspection::Unavailable => {
            return DoctorCheck::new(
                "security.endpoint",
                "security",
                CheckStatus::Warning,
                "endpoint protection inspection unavailable",
            )
            .detail("endpoint products: unavailable");
        }
    };

    if products.is_empty() {
        let (summary, detail) = if cfg!(any(target_os = "macos", target_os = "windows")) {
            ("no supported endpoint protection detected", "none detected")
        } else {
            (
                "endpoint protection is not inspected on this platform",
                "not inspected on this platform",
            )
        };
        return DoctorCheck::new("security.endpoint", "security", CheckStatus::Ok, summary)
            .detail(format!("endpoint products: {detail}"));
    }

    let targets = if cfg!(target_os = "windows") {
        "signed Codex app; codex.exe; codex-windows-sandbox-setup.exe; codex-command-runner.exe; codex-code-mode-host.exe"
    } else if cfg!(target_os = "macos") {
        "signing team 2DC432GLL2 plus the installed Codex app identity, signed codex agent, and required helpers"
    } else {
        "verified Codex app, codex agent, and required helpers"
    };
    let mut check = DoctorCheck::new(
        "security.endpoint",
        "security",
        CheckStatus::Warning,
        "endpoint protection detected; Codex exclusions are unverified",
    )
    .detail(format!("endpoint products: {}", products.join(", ")))
    .detail(format!("exclusion targets: {targets}"))
    .detail("Codex exclusions: not verified")
    .remediation(
        "ask your security administrator to verify Codex exclusions and required helper allowances",
    );
    if visibility_incomplete {
        check = check.detail("additional endpoint products: unavailable");
    }

    for product in products {
        let remedy = match product {
            "CrowdStrike Falcon" => {
                "CrowdStrike Falcon: Add a certificate or IOA exclusion for Codex. If sensor overhead continues, exclude the Codex agent from sensor visibility. Keep monitoring descendant processes."
            }
            "BeyondTrust Privilege Management" => {
                "BeyondTrust: Remove Codex from application blocking rules. Add allow rules for Codex helper executables. Do not grant administrator privileges."
            }
            "Microsoft Defender" => {
                "Microsoft Defender: Add a certificate or executable-path exclusion for Codex and its helpers. If Attack Surface Reduction blocks Codex, add a rule exclusion. If Controlled Folder Access blocks Codex, allow the app."
            }
            "SentinelOne" => {
                "SentinelOne: Add a signer, file-hash, or executable-path exclusion for Codex and its helpers."
            }
            "Jamf Protect" => {
                "Jamf Protect: Add an Override Threat Prevention exception for Codex app and helper signing identities. If analytics cause delays, add an Ignore System Events for Analytics exception."
            }
            _ => {
                "Add an exclusion for Codex and its helpers. Use the endpoint product instructions."
            }
        };
        check = check.issue(
            DoctorIssue::new(
                CheckStatus::Warning,
                format!("{product} can interfere with Codex. Verify Codex exclusions."),
            )
            .measured("not verified")
            .expected("Codex application and helper exclusions")
            .remedy(remedy)
            .field("Codex exclusions"),
        );
    }

    check
}

async fn endpoint_products() -> EndpointInspection {
    #[cfg(target_os = "windows")]
    {
        let system32 = std::env::var_os("SystemRoot")
            .map(PathBuf::from)
            .unwrap_or_else(|| PathBuf::from(r"C:\Windows"))
            .join("System32");
        let service = system32.join("sc.exe");
        let (crowdstrike, beyondtrust, defender, sentinelone) = tokio::join!(
            product_command(&service, &["query", "CSFalconService"]),
            product_command(&service, &["query", "DefendpointService"]),
            product_command(&service, &["query", "WinDefend"]),
            product_command(&service, &["query", "SentinelAgent"]),
        );

        let mut products = Vec::new();
        let mut visibility_incomplete = false;
        for (product, output) in [
            ("CrowdStrike Falcon", crowdstrike),
            ("BeyondTrust Privilege Management", beyondtrust),
            ("Microsoft Defender", defender),
            ("SentinelOne", sentinelone),
        ] {
            match output {
                Some(output) if output.status.success() => {
                    if product != "Microsoft Defender"
                        || String::from_utf8_lossy(&output.stdout).lines().any(|line| {
                            line.split_once(':').is_some_and(|(_, value)| {
                                value.split_whitespace().next() == Some("4")
                            })
                        })
                    {
                        products.push(product);
                    }
                }
                Some(output) if output.status.code() == Some(1060) => {}
                Some(_) | None => visibility_incomplete = true,
            }
        }

        if visibility_incomplete {
            if products.is_empty() {
                EndpointInspection::Unavailable
            } else {
                EndpointInspection::Partial(products)
            }
        } else {
            EndpointInspection::Complete(products)
        }
    }

    #[cfg(target_os = "macos")]
    {
        const PRODUCTS: &[(&str, &str, &str)] = &[
            (
                "CrowdStrike Falcon",
                "X9E956P446",
                "com.crowdstrike.falcon.Agent",
            ),
            (
                "BeyondTrust Privilege Management",
                "2ZS8T6NYB8",
                "com.beyondtrust.endpointsecurity",
            ),
            (
                "Microsoft Defender",
                "UBF8T346G9",
                "com.microsoft.wdav.epsext",
            ),
            (
                "SentinelOne",
                "4AYE5J54KN",
                "com.sentinelone.network-monitoring",
            ),
            (
                "Jamf Protect",
                "483DWKW443",
                "com.jamf.protect.security-extension",
            ),
        ];
        let Some(output) = product_command("/usr/bin/systemextensionsctl", &["list"])
            .await
            .filter(|output| output.status.success())
        else {
            return EndpointInspection::Unavailable;
        };
        EndpointInspection::Complete(
            String::from_utf8_lossy(&output.stdout)
                .lines()
                .filter_map(|line| {
                    let mut columns = line.split_whitespace();
                    if columns.next() != Some("*") || columns.next() != Some("*") {
                        return None;
                    }
                    let team = columns.next()?;
                    let bundle = columns.next()?;
                    PRODUCTS.iter().find_map(|&(name, signer, identifier)| {
                        (team == signer && bundle == identifier).then_some(name)
                    })
                })
                .collect(),
        )
    }

    #[cfg(not(any(target_os = "macos", target_os = "windows")))]
    {
        EndpointInspection::Complete(Vec::new())
    }
}

#[cfg(any(target_os = "macos", target_os = "windows"))]
async fn product_command(program: impl AsRef<OsStr>, args: &[&str]) -> Option<Output> {
    let mut command = Command::new(program);
    command
        .args(args)
        .stdin(Stdio::null())
        .stderr(Stdio::null())
        .kill_on_drop(true);
    timeout(PRODUCT_QUERY_TIMEOUT, command.output())
        .await
        .ok()?
        .ok()
        .filter(|output| output.stdout.len() <= MAX_PRODUCT_OUTPUT_BYTES)
}

#[cfg(test)]
#[path = "security_tests.rs"]
mod tests;