Question for babyjail8

[Xin bor]

Dear professor:

  I had been stuck in the puzzle babyjail8 for a week. Only use "openat" syscall seems didn't work for this puzzle. And I can't get a dir-fd descriptor that points to out of the jail. It's a little hard for me to break through it. So I want to ask for a hint by sending this mail, and I will appreciate for your help.

Best wish.

Student Xin.