fix(sandbox): allow spec-guard reads in rootfs

fix(sandbox): allow spec-guard reads in rootfs #6