It's not clear to me where my Linux gets strlcpy and strlcat from ¯\_(ツ)_/¯
To sandbox apps robustly, we're going to need to always work with canonical absolute paths.