Avoid bind-mounting temporary dirs within sandbox

I'm not sure if this is a bug report or a feature request :-)

Currently, CMS puts files in the sandbox by creating a temporary directory, initializing a sandbox, and bind-mounting the directory inside the sandbox as /tmp. This is not the approach recommended by Isolate's documentation and it leads to multiple problems with file owners and permissions, which might have security implications.

Isolate is started by cmsuser (the user running the worker services), but the process inside the sandbox runs on its own UID (each sandbox has its own). The CMS's temporary directory is owned by cmsuser and writable by everybody. It allows the sandbox user write in this directory. However, if the sandbox user creates a sub-directory not writable by everybody, CMS is then unable to remove its contents, leaving the temporary directory in /tmp forever. Also, the temporary directory is writable by all other users of the system.

The approach recommended by Isolate's documentation is to use the /box directory inside the sandbox. When the sandbox is created, this directory is owned by the caller. When isolate --run is called, the owner of all files inside /box is changed to the sandbox user, and once the sandboxed process finishes, the owner is changed back. This avoids all of the permission problems mentioned above.

I would very much recommend changing the way Isolate uses the sandbox to the recommended one. See also #1005.

Also, when we are at it, we should replace setting the file size limit by proper filesystem quotas (#916).

Trace CMS's sandbox initialization and the temporary-directory bind mount used for /tmp, then read Isolate's documented /box workflow. The change is done when sandbox files use the recommended ownership handling and the reported cleanup and permission risks are addressed; keep the filesystem-quota work in #916 separate and review #1005.