[ericcurtin]

Summary

A private gateway umask (the packaged UMask=0077) made the guest / and /opt/openshell unreadable to the sandbox user.

Related Issue

Closes #4014

Changes

• Create guest rootfs dirs as 0755 whatever the umask.
• Set /overlay/upper to root:root 0755 before the overlay mount.

Release Notes

VM sandboxes now start when the gateway runs with a restrictive umask.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

cargo fmt, cargo clippy -p openshell-driver-vm --all-targets -- -D warnings and cargo test -p openshell-driver-vm pass.

VM e2e vm_overlay under umask 077, gateway uid 1000, sandbox uid 1001: on main both tests fail with read /proc/self/status: Permission denied. With this change both pass.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[ericcurtin]

@elezar @johntmyers could you please accept #4014 so the issue check can pass? PTAL, and /ok to test 1768ec4b3dddb5265efd0c71938ca4b416f47239 if it looks good. Thank you!

[vineethsai7]

Thanks for this. It matches the root cause we hit on RHEL 9 and Ubuntu 24.04 with the deb unit's UMask=0077 (details in #4014), so I closed my #5147 in favour of this PR. One small suggestion if it's useful: in the umask test, also assert that the directories that should stay private (the host-side staging and work directories) are still 0700 after the change, so a later edit can't widen them by accident.

[ericcurtin]

Thanks. Added a test that host state dirs stay 0700.

[TaylorMutch]

/ok to test 62f30d9

[github-actions]

Label test:e2e applied for 62f30d9. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.