sandbox: relative autoetc links

This allows nested containers to use autoetc, and increases compatibility with other implementations.

Signed-off-by: Ophestra <cat@gensokyo.uk>

1 files changed, 12 insertions, 0 deletions

diff --git a/internal/app/seal.go b/internal/app/seal.go
index 4c8fbc78..3c93b34d 100644
--- a/internal/app/seal.go
+++ b/internal/app/seal.go
@@ -301,6 +301,18 @@ func (seal *outcome) finalise(ctx context.Context, sys sys.State, config *fst.Co
 		}
 	}
 
+	if !config.Confinement.Sandbox.AutoEtc {
+		if config.Confinement.Sandbox.Etc != "" {
+			seal.container.Bind(config.Confinement.Sandbox.Etc, "/etc", 0)
+		}
+	} else {
+		etcPath := config.Confinement.Sandbox.Etc
+		if etcPath == "" {
+			etcPath = "/etc"
+		}
+		seal.container.Etc(etcPath, seal.id.String())
+	}
+
 	// inner XDG_RUNTIME_DIR default formatting of `/run/user/%d` as mapped uid
 	innerRuntimeDir := path.Join("/run/user", mapuid.String())
 	seal.container.Tmpfs("/run/user", 1<<12, 0755)