Fix bug in cgroup config introduced by earlier commit.

Commit a6023ce introduced a bug that was causing sysbox-runc
to not setup the continer's cgroups properly, specifically
the softlinks under /sys/fs/cgroup such as:

drwxr-xr-x 3 root root  0 May 13 20:46 blkio
lrwxrwxrwx 1 root root 11 May 13 20:46 cpu -> cpu,cpuacct
drwxr-xr-x 3 root root  0 May 13 20:46 cpu,cpuacct
lrwxrwxrwx 1 root root 11 May 13 20:46 cpuacct -> cpu,cpuacct

(i.e., the softlinks were missing inside the sysbox
container due to a bug in that commit).

This change fixes this.

Signed-off-by: Cesar Talledo <ctalledo@nestybox.com>

libcontainer/rootfs_linux.go

@@ -246,6 +246,7 @@ func mountCgroupV1(m *configs.Mount, enableCgroupns bool, config *configs.Config
 	if err := mountToRootfs(tmpfs, config, enableCgroupns, pipe); err != nil {
 		return err
 	}
+
 	for _, b := range binds {
 		if enableCgroupns {
 
@@ -287,7 +288,11 @@ func mountCgroupV1(m *configs.Mount, enableCgroupns bool, config *configs.Config
 			// symlink(2) is very dumb, it will just shove the path into
 			// the link and doesn't do any checks or relative path
 			// conversion. Also, don't error out if the cgroup already exists.
-			if err := os.Symlink(mc, filepath.Join(m.Destination, ss)); err != nil && !os.IsExist(err) {
+			dest, err := securejoin.SecureJoin(".", filepath.Join(m.Destination, ss))
+			if err != nil {
+				return err
+			}
+			if err := os.Symlink(mc, dest); err != nil && !os.IsExist(err) {
 				return err
 			}
 		}