Run sandbox checker in temp directory

[dra27]

The sandbox will attempt to mount the current working directory which may fail (and which we don't necessarily have any business doing).

[dra27]

Revised: we're supposed to be avoiding /tmp, so making it the rw CWD seems a bit weird! OpamSystem.in_tmp_dir added which does what OpamSystem.with_tmp_dir claimed to do - it creates a temporary directory and then actually calls the function in it.

As a result, it's possible to simplify the sandbox check, as OpamSystem.in_tmp_dir also cleans up the directory, so I changed the check to use tee instead. I also verified that it fails by changing the path to /tmp/check-write 🙂

[kit-ty-kate]

The underlying issue in #4783 is that /media is not mounted by the sandbox
I think a better fix would be to simply fix the sandbox to mount / readonly instead of selecting which directory need to be ro-mounted.

This would also make the linux sandbox match the macOS sandbox (which does not have this distinction).
I believe this would also fix #4751 at the same time.

[dra27]

That's the underlying cause, it's not the underlying issue. Given that opam is doing nothing in the CWD, it definitely has no business at all mounting it in the sandbox, much less mounting it RW (when the sandbox is called normally, the CWD is already the build directory in an opam root). See also the concern for handling of symlinks in add_mounts vs add_sys_mounts in the sandbox script.

In #4751, the problem is that opam root is not accessible, which does still need fixing.

[rjbou]

double approval : checked, working perfectly. Thanks!

[rjbou]

Thanks!