commit cc1d425

Sandbox fixes

- allow reading `/dev/urandom` as it is shown as a failed syscall when
  tracing
- resolve `/etc/ssl/cert.pem` in case it is a symlink

 1@@ -71,15 +71,22 @@ LL_BEGIN(sbox_enter_linux_, const char* basedir, const char *address, int smail)
 2              LANDLOCK_ACCESS_FS_REFER_COMPAT,
 3         s  = LANDLOCK_ACCESS_FS_MAKE_SOCK,
 4         x  = LANDLOCK_ACCESS_FS_EXECUTE;
 5+    char *resolved_path = NULL;
 6 
 7     LL_PATH(basedir,                rf|rd|w|c);
 8     LL_PATH("/tmp",                 rf|rd|w|c);
 9 #ifndef WITHOUT_SHM
10     LL_PATH("/dev/shm",             rf|w|c   );
11 #endif
12+    LL_PATH("/dev/urandom",         rf       );
13     LL_PATH("/etc/resolv.conf",     rf       );
14     LL_PATH("/etc/hosts",           rf       );
15-    LL_PATH("/etc/ssl",             rf       );
16+    LL_PATH("/etc/ssl",             rf|rd    );
17+    if ((resolved_path = realpath("/etc/ssl/cert.pem", NULL))) {
18+        /* some distros like cert.pem to be a symlink */
19+        LL_PATH(resolved_path,      rf       );
20+        free(resolved_path);
21+    }
22     LL_PATH("/usr/share/zoneinfo",  rf       );
23 
24     if (mtime("/etc/pki") > 0)