app: run in native sandbox

Signed-off-by: Ophestra <cat@gensokyo.uk>

sandbox/seccomp/export_test.go

@@ -93,7 +93,7 @@ func TestExport(t *testing.T) {
 				t.Errorf("Close: error = %v", err)
 				return
 			}
-			if got := digest.Sum(nil); slices.Compare(got, tc.want) != 0 {
+			if got := digest.Sum(nil); !slices.Equal(got, tc.want) {
 				t.Fatalf("Export() hash = %x, want %x",
 					got, tc.want)
 				return

sandbox/sequential.go

@@ -301,7 +301,15 @@ func (l *Symlink) apply(*Params) error {
 		return msg.WrapErr(syscall.EBADE,
 			fmt.Sprintf("path %q is not absolute", l[1]))
 	}
-	if err := os.Symlink(l[0], toSysroot(l[1])); err != nil {
+
+	target := toSysroot(l[1])
+	if err := ensureFile(target, 0444, 0755); err != nil {
+		return err
+	}
+	if err := os.Remove(target); err != nil {
+		return msg.WrapErr(err, err.Error())
+	}
+	if err := os.Symlink(l[0], target); err != nil {
 		return msg.WrapErr(err, err.Error())
 	}
 	return nil

sandbox/syscall.go

@@ -22,14 +22,6 @@ func SetDumpable(dumpable uintptr) error {
 	return nil
 }
 
-func SetPdeathsig(sig syscall.Signal) error {
-	if _, _, errno := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_SET_PDEATHSIG, uintptr(sig), 0); errno != 0 {
-		return errno
-	}
-
-	return nil
-}
-
 // IgnoringEINTR makes a function call and repeats it if it returns an
 // EINTR error. This appears to be required even though we install all
 // signal handlers with SA_RESTART: see #22838, #38033, #38836, #40846.