···5151 filename = "/dev/null";
52525353 struct vchroot_expand_args vc;
5454- vc.flags = VCHROOT_FOLLOW;
5454+ vc.flags = (flags & BSD_O_SYMLINK || flags & BSD_O_NOFOLLOW) ? 0 : VCHROOT_FOLLOW;
5555 vc.dfd = atfd(fd);
56565757 strcpy(vc.path, filename);
···5959 if (ret < 0) {
6060 return errno_linux_to_bsd(ret);
6161 }
6262+6363+ // when we're given O_SYMLINK, `oflags_bsd_to_linux` translates it into
6464+ // O_NOFOLLOW and O_PATH
6565+ // this is the only way to open the symlink itself on Linux
6666+ // unfortunately, this presents additional challenges
6767+ // only a select few Linux syscalls support O_PATH descriptors, which means
6868+ // that for other syscalls, we either have to check for this and use an
6969+ // `l` variant (e.g. `llistxattr` instead of `listxatrr`) or we're screwed
62706371 ret = LINUX_SYSCALL(__NR_openat, vc.dfd, vc.path, linux_flags, mode);
6472 if (ret < 0)