tmp is already a union directory (I'm assuming) so that the

	plan9% bind -ac /sys tmp

is binding a directory with create permissions behind a mount point
that already has a directory with create permissions.