system/wayland: sync file at caller specified address

Storing this in sys is incredibly ugly: sys should be stateless and Ops must keep track of their state.

Signed-off-by: Ophestra <cat@gensokyo.uk>

internal/app/system.go

@@ -1,6 +1,8 @@
 package app
 
 import (
+	"os"
+
 	"git.gensokyo.uk/security/fortify/helper/bwrap"
 	"git.gensokyo.uk/security/fortify/internal/system"
 )
@@ -8,6 +10,8 @@ import (
 // appSealSys encapsulates app seal behaviour with OS interactions
 type appSealSys struct {
 	bwrap *bwrap.Config
+	// bwrap sync fd
+	sp *os.File
 	// paths to override by mounting tmpfs over them
 	override []string