bind mount resolves source path inside guest instead of host

[c8763yee]

The -b SRC:DST option is documented as bind-mounting a host path into the guest, but the source path is actually resolved inside the guest. This makes host-to-guest bind mounts non-functional as advertised in the Quick Start section of the README.

Expected behavior

-b /home/user/data:/mnt/data should make /home/user/data (host) accessible at /mnt/data (guest)

Actual behavior

When the source path exists inside the guest, kbox mounts guest's source into target. When the source path does not exist inside the guest, it triggers an error "bind mount -> : No such file or directory"

Case 1: source path exists inside the guest

$ ./kbox -r alpine.ext4 --syscall-mode=seccomp -b /etc/modprobe.d:/test-bind

/ # ls /etc/modprobe.d /test-bind -alhs
/etc/modprobe.d:
total 24K    
   4.0K drwxr-xr-x    2 1000     1000        4.0K Dec  5  2024 .
   4.0K drwxr-xr-x   17 1000     1000        4.0K Dec  5  2024 ..
   4.0K -rw-r--r--    1 1000     1000        1.5K Sep 16  2024 aliases.conf
   4.0K -rw-r--r--    1 1000     1000        2.1K Sep 16  2024 blacklist.conf
   4.0K -rw-r--r--    1 1000     1000         122 Sep 16  2024 i386.conf
   4.0K -rw-r--r--    1 1000     1000          91 Sep 16  2024 kms.conf

/test-bind:
total 24K    
   4.0K drwxr-xr-x    2 1000     1000        4.0K Dec  5  2024 .
   4.0K drwxr-xr-x   24 root     root        4.0K Jan  1  1970 ..
   4.0K -rw-r--r--    1 1000     1000        1.5K Sep 16  2024 aliases.conf
   4.0K -rw-r--r--    1 1000     1000        2.1K Sep 16  2024 blacklist.conf
   4.0K -rw-r--r--    1 1000     1000         122 Sep 16  2024 i386.conf
   4.0K -rw-r--r--    1 1000     1000          91 Sep 16  2024 kms.conf

/ # diff /test-bind/blacklist.conf /etc/modprobe.d/blacklist.conf
/ #  

$ ls /etc/modprobe.d
mlx4.conf  truescale.conf

Case 2: source path does not exist inside the guest

$ ./kbox -r alpine.ext4 --syscall-mode=seccomp -b $HOME:/host-home
bind mount /home/c8763yee -> /host-home: No such file or directory

[c8763yee]

Tested platform

• x86-64: kernel version 6.19.11
• AArch64: kernel version 6.12.47 (Rpi5)

[jserv]

The -b SRC:DST option is documented as bind-mounting a host path into the guest, but the source path is actually resolved inside the guest. This makes host-to-guest bind mounts non-functional as advertised in the Quick Start section of the README.

Address security model as well.