Keep OpenVMM's report and console files readable under a restrictive umask #651

Summary

An OpenVMM that nvx::host::process::launch spawns inherits the caller's umask. OpenVMM does not set the modes of the files it creates for the caller again, so under a umask that clears the owner's own read permission (for example 0400), the owner cannot read them:

• The microVM report (openvmm/openvmm/openvmm_entry/src/microvm/report.rs) is staged in a tempfile created with mode 0600 and published without a chmod, so umask 0400 publishes it with mode 0200.
• A console captured to a file (file_serial in openvmm/openvmm/openvmm_entry/src/serial_io.rs) is opened with create(true) (mode 0666), so umask 0400 leaves it at 0266.

The sandbox store already sets the modes of its own files again (#628), so its records stay usable under such a umask; this issue covers only the files that OpenVMM writes.

Options

1. In nvx-rs, set a fixed umask such as 0o077 in the child's existing pre_exec hook (nvx-rs/src/host/sys/process.rs, detach). This also changes a console file from 0644 to 0600 under the common umask 022.
2. In OpenVMM, set the intended mode of the report and the console file explicitly after creating them.

Notes

A umask that clears the owner's own permissions is unusual. This was found in the final review of #628 and deferred there as out of scope.