Tor should be able to read all files it creates when Sandbox enabled.
After #12035 (moved) and #12041 (moved), I realized that there are probably a lot of files that tor creates that are not specifically allowed in the sandbox. I've not tested all of these to make sure there is actually a bug, but these are the files listed in the torrc documentation that I don't see mentioned in
sandbox_cfg_allow_open_filename_array() or elsewhere in
Part 1 (Stuff I have a patch for):
DataDirectory/status/entry-stats DataDirectory/status/exit-stats DataDirectory/status/buffer-stats DataDirectory/status/conn-stats
Part 2 (Marked obsolete in docs... patch not necessary?):
DataDirectory/cached-routers and cached-routers.new DataDirectory/bw_accounting
Part 3 (Stuff I'm unsure of):
Part 4 (Hidden Directory Files - tested, broken because unable to read private_key):
HiddenServiceDirectory/hostname HiddenServiceDirectory/private_key HiddenServiceDirectory/client_keys
A patch for part 1 is inbound (based off the fixes for the previous bugs). Someone else will need to write any patches for parts 2 - 4.