sandbox can mishandle symlink outputs

[benjaminp]

Consider these genrules that emit symlinks:

$ cat BUILD
genrule(
    name = 'test1',
    outs = ['file1', 'link1'],
    cmd = 'touch $(location file1); ln -s file1 $(location link1)',
)

genrule(
    name = 'test2',
    outs = ['link2', 'file2'],
    cmd = 'touch $(location file2); ln -s file2 $(location link2)',
)
$ bazel build //:test1 //:test2
$ ls -lh bazel-genfiles/
total 0
-r-xr-xr-x 1 benjamin benjamin 0 Apr  9 13:24 file1
-r-xr-xr-x 1 benjamin benjamin 0 Apr  9 13:24 file2
lrwxrwxrwx 1 benjamin benjamin 5 Apr  9 13:24 link1 -> file1
lrwxrwxrwx 1 benjamin benjamin 5 Apr  9 13:24 link2 -> file2

So far, so good. Unfortunately, things work less well when the real execroot is on a different filesystem than the sandbox execroot:

$ bazel clean
$ bazel build --experimental_sandbox_base /run/shm/sandbox-fs  --keep_going //:test1 //:test2
INFO: Analysed 2 targets (7 packages loaded).
INFO: Found 2 targets...
ERROR: BUILD:1:1: Couldn't build file file1: Executing genrule //:test1 failed: I/O exception during sandboxed execution: Could not move output artifacts from sandboxed execution
INFO: Elapsed time: 1.901s, Critical Path: 0.09s
INFO: 0 processes.
FAILED: Build did NOT complete successfully
$ ls -lh bazel-genfiles/
total 0
-rw-rw-r-- 1 benjamin benjamin 0 Apr  9 13:26 file1
-r-xr-xr-x 1 benjamin benjamin 0 Apr  9 13:26 file2
-r-xr-xr-x 1 benjamin benjamin 0 Apr  9 13:26 link2

Not only does the building one of the genrules fail, but the sandbox has silently replaced the symbolic link link2 with a regular file!