sandbox: prepare ops early

Some setup code needs to run in host root. This change allows that to happen.

Signed-off-by: Ophestra <cat@gensokyo.uk>

sandbox/mount.go

@@ -14,6 +14,7 @@ const (
 	BindWritable
 	BindDevice
 
+	bindResolved
 	bindAbsolute
 	bindRecursive
 )
@@ -22,26 +23,21 @@ func bindMount(src, dest string, flags int) error {
 	target := toSysroot(dest)
 	var source string
 
-	if flags&BindSource == 0 {
-		// this is what bwrap does, so the behaviour is kept for now,
-		// however recursively resolving links might improve user experience
-		if rp, err := realpathHost(src); err != nil {
-			if os.IsNotExist(err) {
-				if flags&BindOptional != 0 {
-					return nil
-				} else {
-					return msg.WrapErr(err,
-						fmt.Sprintf("path %q does not exist", src))
-				}
-			}
-			return msg.WrapErr(err, err.Error())
-		} else {
-			source = toHost(rp)
+	if flags&BindSource != 0 {
+		if flags&BindOptional != 0 {
+			return msg.WrapErr(syscall.EINVAL,
+				"flag source excludes optional")
+		}
+	} else if flags&bindResolved == 0 {
+		return msg.WrapErr(syscall.EBADE,
+			"flag source must be set on direct bind call")
+	}
+
+	if flags&bindAbsolute != 0 {
+		if flags&BindSource == 0 {
+			return msg.WrapErr(syscall.EINVAL,
+				"flag absolute implies source")
 		}
-	} else if flags&BindOptional != 0 {
-		return msg.WrapErr(syscall.EINVAL,
-			"flag source excludes optional")
-	} else if flags&bindAbsolute != 0 {
 		source = src
 	} else {
 		source = toHost(src)
@@ -51,8 +47,7 @@ func bindMount(src, dest string, flags int) error {
 		return msg.WrapErr(err, err.Error())
 	} else if fi.IsDir() {
 		if err = os.MkdirAll(target, 0755); err != nil {
-			return wrapErrSuffix(err,
-				fmt.Sprintf("cannot create directory %q:", dest))
+			return msg.WrapErr(err, err.Error())
 		}
 	} else if err = ensureFile(target, 0444); err != nil {
 		if errors.Is(err, syscall.EISDIR) {
@@ -87,7 +82,7 @@ func bindMount(src, dest string, flags int) error {
 func mountTmpfs(fsname, name string, size int, perm os.FileMode) error {
 	target := toSysroot(name)
 	if err := os.MkdirAll(target, perm); err != nil {
-		return err
+		return msg.WrapErr(err, err.Error())
 	}
 	opt := fmt.Sprintf("mode=%#o", perm)
 	if size > 0 {