fix(sandbox): allow spec-guard reads in rootfs

Author: rschlaefli

.github/workflows/ci.yml

@@ -57,6 +57,7 @@ jobs:
         working-directory: api/src
         run: |
           gcc -O2 -static -Wall -Wextra -Werror -o /tmp/spec-guard spec-guard.c
+          chmod 0555 /tmp/spec-guard
           # Smoke: spec-guard must execvp its argument cleanly. Use a
           # parent process with a known FD population so we also assert
           # the close-inherited-FDs path runs (child must see only the

api/Dockerfile

@@ -29,8 +29,9 @@ RUN git clone -b master --single-branch https://github.com/google/nsjail.git . \
 RUN make -j$(nproc)
 
 COPY api/src/spec-guard.c /tmp/spec-guard.c
+# KVM/nsjail execution may need read permission on virtiofs-backed rootfs.
 RUN gcc -O2 -static -o /usr/local/bin/spec-guard /tmp/spec-guard.c \
-    && chmod 0111 /usr/local/bin/spec-guard
+    && chmod 0555 /usr/local/bin/spec-guard
 
 # ============================================================================
 # Stage 1b: Build language runtime packages (only consumed by sandbox-runner-baked)

docker/Dockerfile.worker-sandbox

@@ -42,8 +42,9 @@ RUN git clone -b master --single-branch https://github.com/google/nsjail.git . \
 RUN make -j$(nproc)
 
 COPY api/src/spec-guard.c /tmp/spec-guard.c
+# KVM/nsjail execution may need read permission on virtiofs-backed rootfs.
 RUN gcc -O2 -static -o /usr/local/bin/spec-guard /tmp/spec-guard.c \
-    && chmod 0111 /usr/local/bin/spec-guard
+    && chmod 0555 /usr/local/bin/spec-guard
 
 # ============================================================================
 # Stage 2: Build worker

launcher/Dockerfile

@@ -33,8 +33,9 @@ RUN git clone -b master --single-branch https://github.com/google/nsjail.git . \
 RUN make -j$(nproc)
 
 COPY api/src/spec-guard.c /tmp/spec-guard.c
+# KVM/nsjail execution may need read permission on virtiofs-backed rootfs.
 RUN gcc -O2 -static -o /usr/local/bin/spec-guard /tmp/spec-guard.c \
-    && chmod 0111 /usr/local/bin/spec-guard
+    && chmod 0555 /usr/local/bin/spec-guard
 
 FROM oven/bun:1.3.14-debian AS sandbox-build