cmd/flaunch: implement app bundle wrapper

This tool creates fortify configuration for running an application bundle. The activate action wraps a home-manager activation package and ensures each generation gets activated once.

Signed-off-by: Ophestra <cat@gensokyo.uk>

fst/config.go

@@ -153,14 +153,14 @@ func (s *SandboxConfig) Bwrap(os linux.System) (*bwrap.Config, error) {
 	}
 
 	if s.AutoEtc {
-		etc := s.Etc
-		if etc == "" {
-			etc = "/etc"
+		if s.Etc == "" {
+			conf.Bind("/etc", Tmp+"/etc")
+		} else {
+			conf.Bind(s.Etc, Tmp+"/etc")
 		}
-		conf.Bind(etc, Tmp+"/etc")
 
 		// link host /etc contents to prevent passwd/group from being overwritten
-		if d, err := os.ReadDir(etc); err != nil {
+		if d, err := os.ReadDir("/etc"); err != nil {
 			return nil, err
 		} else {
 			for _, ent := range d {