"H. Peter Anvin" [off-list ref] writes:
At the very least, if you insist on using getcwd() names, you should
pre-canonicalize the whitelist, too.
With the current "prefix" rule (and not allowing /ho to match
/home) that sounds possible and sensivle, but that is not nice
in the long run. We may later want to say "/pub/git/**/*.git"
for example to mean "any subdirectory under /pub/git but the
base directory name must be something ending with '.git'".
Hmm...