Comment # 2 on bug 1219985 from Pablo Suárez Hernández

Due to the CVE fixes, for security reasons the symlinks would ONLY work if the
targetted file is part of the same "file_root".

By default, the "file_roots" for a Salt Master (and also for salt-call --local
execution) are:

base:
    - /srv/salt
    - /srv/spm/salt

If you have formulas in other directories that you want to expose in the Salt
fileserver, then maybe what you would need is to add it to the "file_roots" in
Salt Master configuration (i.a. /etc/salt/master.d/custom.conf or minion
configuration). Something like this:

file_roots:
  base:
    - /srv/salt/
    - /srv/spm/salt
    - /srv/formula/

Then you could remove the symlinks as the formulas will be exposed in the Salt
fileserver as they are part of the file roots.

Would that work for you?