tree 07c473a7754057e99e6c81b00172b9a1a43c0e96
parent 3b77da4a5eb7d0ee3bdeb02cc7b1ccad7caaa8ad
author jmmv <jmmv@google.com> 1552945905 -0700
committer Copybara-Service <copybara-worker@google.com> 1552946004 -0700

Map symlinks into sandboxfs as they are and propagate their targets.

We expect rules to map all the input files they need, including the targets
of those symlinks.  Unfortunately, not all rules currently abide by this
principle, which means that using the stricter sandboxfs sandboxing causes
these rules to fail.

In order to mitigate this problem and to have an escape hatch for using
sandboxfs in the presence of these bugs, compute what the targets of the
symlinks are and map them automatically within the sandbox unless they were
explicitly mapped.

But because we treat this condition as a bug in the rules (and because
doing this computation is not trivial), this behavior is optional and is
disabled by default.  Users encountering this problem in the rules they use
(or in their own rules) can temporarily enable the looser sandboxing by
setting --experimental_sandboxfs_map_symlink_targets.

RELNOTES: None.
PiperOrigin-RevId: 239066555