The bwrap fhs userenv uses readlink -f to resolve symlinks. It is called
in the argument list of bwrap like this:
--ro-bind-try $(readlink -f /etc/ssl/certs) /etc/ssl/certs
Normally, readlink -f returns the passed path if there is no file at the
path. However, this only works, if the parent directory of the file
exists. Thus if /etc/ssl does not exist, readlink -f /etc/ssl/certs will
return nothing. This causes the argument list of bwrap to be wrong (it
has only one argument to --ro-bind-try when it expected two), which
causes it to fail with hard to track down errors.
Simon Bruder