fix(vm): make sandbox process startup fork-safe

architecture/sandbox.md

@@ -21,6 +21,20 @@ container-granted capabilities. This is fail-closed: the supervisor retains
 aborts unless the bounding set ends up empty. A `setpcap` `EPERM` is tolerated
 only when the set is already empty; any other outcome fails the spawn.
 
+Before it forks, the supervisor resolves the executable path, named users,
+groups, supplementary memberships, Landlock path handles, and runtime seccomp
+programs. Entrypoint and SSH child hooks receive only prepared values. The
+post-fork child performs the unavoidable namespace, credential, hardening,
+Landlock, seccomp-install, and exec syscalls; it does not perform name-service
+lookups, PATH search, filter compilation, tracing, or successful-path heap
+cleanup. Both launch paths therefore have the same identity and enforcement
+semantics without invoking process-global runtime services after fork.
+
+The VM driver also mirrors the selected lower root filesystem's owner and mode
+onto the overlay upper root before mounting it. This prevents the host process
+umask or host UID from making the merged guest root untraversable by the sandbox
+identity.
+
 ## Startup Flow
 
 1. The compute runtime starts the workload with sandbox identity, callback

crates/openshell-driver-vm/scripts/openshell-vm-sandbox-init.sh

@@ -270,6 +270,14 @@ setup_overlay_root() {
         fi
     fi
 
+    # Overlayfs exposes the upperdir root inode as the merged mount's root.
+    # The host creates the overlay template under a restrictive umask, so its
+    # upperdir may otherwise be 0700 and owned by the host UID. Mirror the
+    # selected lower root before mounting so named sandbox users can traverse
+    # `/` and the workload cannot own the sandbox filesystem root.
+    chown --reference="$lower_root" /overlay/upper
+    chmod --reference="$lower_root" /overlay/upper
+
     mount -t overlay overlay \
         -o lowerdir="$lower_root",upperdir=/overlay/upper,workdir=/overlay/work \
         /newroot

crates/openshell-driver-vm/src/rootfs.rs

@@ -14,6 +14,7 @@ const SUPERVISOR: &[u8] = include_bytes!(concat!(env!("OUT_DIR"), "/openshell-sa
 const UMOCI: &[u8] = include_bytes!(concat!(env!("OUT_DIR"), "/umoci.zst"));
 const ROOTFS_VARIANT_MARKER: &str = ".openshell-rootfs-variant";
 const SANDBOX_GUEST_INIT_PATH: &str = "/srv/openshell-vm-sandbox-init.sh";
+const SANDBOX_GUEST_INIT_SCRIPT: &str = include_str!("../scripts/openshell-vm-sandbox-init.sh");
 const SANDBOX_SUPERVISOR_PATH: &str = openshell_core::driver_utils::SUPERVISOR_CONTAINER_BINARY;
 const SANDBOX_UMOCI_PATH: &str = openshell_core::container_paths::VM_UMOCI_PATH;
 const SANDBOX_OWNER_NORMALIZED_MARKER: &str =
@@ -362,11 +363,8 @@ fn prepare_sandbox_rootfs(rootfs: &Path, sandbox_uid: u32, sandbox_gid: u32) ->
     if let Some(parent) = init_path.parent() {
         fs::create_dir_all(parent).map_err(|e| format!("create {}: {e}", parent.display()))?;
     }
-    fs::write(
-        &init_path,
-        include_str!("../scripts/openshell-vm-sandbox-init.sh"),
-    )
-    .map_err(|e| format!("write {}: {e}", init_path.display()))?;
+    fs::write(&init_path, SANDBOX_GUEST_INIT_SCRIPT)
+        .map_err(|e| format!("write {}: {e}", init_path.display()))?;
     #[cfg(unix)]
     {
         use std::os::unix::fs::PermissionsExt as _;
@@ -948,6 +946,25 @@ mod tests {
     use std::sync::atomic::{AtomicU64, Ordering};
     use std::time::{SystemTime, UNIX_EPOCH};
 
+    #[test]
+    fn guest_init_preserves_lower_root_metadata_before_overlay_mount() {
+        let chown = SANDBOX_GUEST_INIT_SCRIPT
+            .find("chown --reference=\"$lower_root\" /overlay/upper")
+            .expect("guest init must preserve the lower root owner");
+        let chmod = SANDBOX_GUEST_INIT_SCRIPT
+            .find("chmod --reference=\"$lower_root\" /overlay/upper")
+            .expect("guest init must preserve the lower root mode");
+        let mount = SANDBOX_GUEST_INIT_SCRIPT
+            .find("mount -t overlay overlay")
+            .expect("guest init must mount the overlay");
+
+        assert!(
+            chown < mount,
+            "upper root ownership must be fixed before mount"
+        );
+        assert!(chmod < mount, "upper root mode must be fixed before mount");
+    }
+
     #[test]
     fn prepare_sandbox_rootfs_rewrites_guest_layout() {
         let dir = unique_temp_dir();