commit c2ba4a08a788097297da81b58e2fb9ffdb22a581
author jmmv <jmmv@google.com> Mon Mar 18 14:51:45 2019 -0700
committer Copybara-Service <copybara-worker@google.com> Mon Mar 18 14:53:24 2019 -0700
tree 07c473a7754057e99e6c81b00172b9a1a43c0e96
parent 3b77da4a5eb7d0ee3bdeb02cc7b1ccad7caaa8ad

Map symlinks into sandboxfs as they are and propagate their targets.

We expect rules to map all the input files they need, including the targets
of those symlinks.  Unfortunately, not all rules currently abide by this
principle, which means that using the stricter sandboxfs sandboxing causes
these rules to fail.

In order to mitigate this problem and to have an escape hatch for using
sandboxfs in the presence of these bugs, compute what the targets of the
symlinks are and map them automatically within the sandbox unless they were
explicitly mapped.

But because we treat this condition as a bug in the rules (and because
doing this computation is not trivial), this behavior is optional and is
disabled by default.  Users encountering this problem in the rules they use
(or in their own rules) can temporarily enable the looser sandboxing by
setting --experimental_sandboxfs_map_symlink_targets.

RELNOTES: None.
PiperOrigin-RevId: 239066555

src/main/java/com/google/devtools/build/lib/sandbox/LinuxSandboxedStrategy.java

diff --git a/src/main/java/com/google/devtools/build/lib/sandbox/LinuxSandboxedStrategy.java b/src/main/java/com/google/devtools/build/lib/sandbox/LinuxSandboxedStrategy.java
index 154ac79..4d3d85d 100644
--- a/src/main/java/com/google/devtools/build/lib/sandbox/LinuxSandboxedStrategy.java
+++ b/src/main/java/com/google/devtools/build/lib/sandbox/LinuxSandboxedStrategy.java
@@ -49,10 +49,15 @@
    * @param timeoutKillDelay additional grace period before killing timing out commands
    * @param sandboxfsProcess instance of the sandboxfs process to use; may be null for none, in
    *     which case the runner uses a symlinked sandbox
+   * @param sandboxfsMapSymlinkTargets map the targets of symlinks within the sandbox if true
    */
   static LinuxSandboxedSpawnRunner create(
-      CommandEnvironment cmdEnv, Path sandboxBase, Duration timeoutKillDelay,
-      @Nullable SandboxfsProcess sandboxfsProcess) throws IOException {
+      CommandEnvironment cmdEnv,
+      Path sandboxBase,
+      Duration timeoutKillDelay,
+      @Nullable SandboxfsProcess sandboxfsProcess,
+      boolean sandboxfsMapSymlinkTargets)
+      throws IOException {
     Path inaccessibleHelperFile = sandboxBase.getRelative("inaccessibleHelperFile");
     FileSystemUtils.touchFile(inaccessibleHelperFile);
     inaccessibleHelperFile.setReadable(false);
@@ -71,6 +76,7 @@
         inaccessibleHelperFile,
         inaccessibleHelperDir,
         timeoutKillDelay,
-        sandboxfsProcess);
+        sandboxfsProcess,
+        sandboxfsMapSymlinkTargets);
   }
 }