This will change /foo/symlink to /bar/target where we didn't before. That's not an enormous deal, but realpath will fail within a capsicum sandbox as it needs to be able to stat every component of the path, including "/". I'd prefer to only use realpath on relative paths for this reason.

So do you want realpath(3) at all there ?

I can test with cap_getmode(2) and only call realpath if not in cap mode.

This is also a valid question for $ORIGIN resolution, where we use realpath(3) as well. See some minimal discussion with completely wrong patch at D23043.