Function ensure_inside 

fn ensure_inside(root: &Path, path: &Path, orig: &Path) -> Result<()>

Fails if the nearest existing ancestor of path resolves outside root, for example through a linked directory.