kvm: partial fix for mounting symlinks

stage1/init/common/kvm_mount.go

@@ -81,13 +81,14 @@ func MountSharedVolumes(root string, appName types.ACName, volumes []types.Volum
 		}
 
 		destination := filepath.Join(appRootfs, mntPath)
-		// TODO: verify if rkt should do this, or it should be some outer responsibility
-		// to ensure if such patch exists
-		if err := ensureDestinationExists(source, destination); err != nil {
+		// TODO: check if symlinked source tries to escape root
+		// TODO: verify if rkt should ensure existance of destination there, or it should be some
+		// outer responsibility to ensure if such path exists
+		if cleanedSource, err := filepath.EvalSymlinks(source); err != nil {
+			return errwrap.Wrap(fmt.Errorf("could not resolve symlink for source: %v", source), err)
+		} else if err := ensureDestinationExists(cleanedSource, destination); err != nil {
 			return errwrap.Wrap(fmt.Errorf("could not create destination mount point: %v", destination), err)
-		}
-
-		if err := doBindMount(source, destination, readOnly); err != nil {
+		} else if err := doBindMount(cleanedSource, destination, readOnly); err != nil {
 			return errwrap.Wrap(fmt.Errorf("could not bind mount path %v (s: %v, d: %v)", m.Path, source, destination), err)
 		}
 	}