--incompatible_sandbox_hermetic_tmp breaks virtual includes if using output base under /tmp

[thii]

Description of the bug:

As the title says, --incompatible_sandbox_hermetic_tmp (default since Bazel 7) breaks virtual includes if building with an output base starts with /tmp.

Which category does this issue belong to?

No response

What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

1. Create a directory like this:

repro-bazel-virtual-includes » tree
.
├── BUILD
├── include
│   ├── BUILD
│   └── h.h
├── main.c
└── WORKSPACE

Where:

BUILD

cc_library(
    name = "main",
    srcs = ["main.c"],
    deps = ["@include//:h"],
)

include/BUILD

cc_library(
    name = "h",
    hdrs = ["h.h"],
    include_prefix = "prefix/",
    visibility = ["//visibility:public"],
)

h.h is an empty file.

main.c

#include <prefix/h.h>

WORKSPACE

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
http_archive(
    name = "include",
    url = "file:///home/user/repro-bazel-virtual-includes/include.tar.gz", # replace with your local path
    strip_prefix = "include",
)

2. Create include.tar.gz with (needs to be a tarball -- can't reproduce with a local_repository):

tar czf include.tar.gz include

3. Run:

bazel --output_base=/tmp/outbase build //:main

INFO: Analyzed target //:main (68 packages loaded, 300 targets configured).
ERROR: /home/user/repro-bazel-virtual-includes/BUILD:1:11: Compiling main.c failed: (Exit 1): gcc failed: error executing CppCompile command (from target //:main) /usr/bin/gcc -U_FORTIFY_SOURCE -fstack-protector -Wall -Wunused-but-set-parameter -Wno-free-nonheap-object -fno-omit-frame-pointer -MD -MF bazel-out/k8-fastbuild/bin/_objs/main/main.pic.d ... (remaining 20 arguments skipped)

Use --sandbox_debug to see verbose messages from the sandbox and retain the sandbox build root for debugging
main.c:1:10: fatal error: prefix/h.h: No such file or directory
    1 | #include <prefix/h.h>
      |          ^~~~~~~~~~~~
compilation terminated.
Target //:main failed to build
Use --verbose_failures to see the command lines of failed build steps.
INFO: Elapsed time: 2.364s, Critical Path: 0.04s
INFO: 5 processes: 5 internal.
ERROR: Build did NOT complete successfully

The following command works:

bazel build //:main

Which operating system are you running Bazel on?

Linux

What is the output of bazel info release?

7.1.1 release

If bazel info release returns development version or (@non-git), tell us how you built Bazel.

No response

What's the output of git remote get-url origin; git rev-parse HEAD ?

No response

Is this a regression? If yes, please try to identify the Bazel commit where the bug was introduced.

No response

Have you found anything relevant by searching the web?

No response

Any other information, logs, or outputs that you want to share?

No response

[thii]

cc @fmeum