fix(env): private-glibc strip was defeated by the composed override

Found while attributing an e2e 156 failure on this branch (NOT caused by the
staging change — proven by diffing the generated build.ninja for that exact
project: it differs only in an unused rule's text).

`process.cppm::merged_environ` strips mcpp's private-glibc payload entries from
an INHERITED LD_LIBRARY_PATH, and plan.cppm's comment states that guarantee. But
merged_environ takes explicit `extra` overrides verbatim, and
`env::prepend_path_list` — which composes exactly such an override for ninja and
for run targets — appended the inherited value RAW. So the strip was bypassed
precisely in the case it exists for: a nested `mcpp run` → `mcpp test` chain,
where a payload tool patched against a different glibc then segfaults inside the
dynamic linker before main (bare `__vdso_time`, then SIGSEGV).

The predicate moves to mcpp.platform.env, next to path-list composition, since
both halves of the guarantee need it; prepend_path_list now sanitizes only the
inherited TAIL, so a payload dir the caller passed explicitly — the entry the
sandbox binary actually needs — always survives. PATH is untouched.

Why it looked like a regression: the two CI runs restored DIFFERENT sandbox
caches (…-01baa227… vs …-0e74cc64…), so the payload version set differed and the
latent bug only showed on one side. Before this fix, 156 was green only when the
poisoned payload version happened to match what the tools expected.

Author: Sunrisepeak

CHANGELOG.md

@@ -23,6 +23,13 @@
 
   一条记录在案的实现约束:**跳过时对 mtime 的任何触碰(包括对齐到 src 的 mtime)都会让 restat 失效并重新引发级联** —— ninja 的 restat 只把「mtime 未被命令改变」的输出视为从未需要构建。所以跳过路径不动任何时间戳。
 
+- **私有 glibc 的 strip 不再被「组合出的显式覆盖」绕过。** `process.cppm::merged_environ` 会把继承来的 `LD_LIBRARY_PATH` 里的私有 glibc payload 条目剥掉,但**显式 `extra` 覆盖是原样采用的**;而 `env::prepend_path_list` 组合该覆盖时,把继承值(含毒)整段追加了进去 —— 于是 strip 恰好在它唯一有用的场景下失效:嵌套的 `mcpp run` → `mcpp test` 链里,子工具拿到一个**版本不匹配**的 libc.so.6,在动态链接器里 main 之前 SIGSEGV(签名:一行裸 `__vdso_time`)。
+
+  修法是把判据下沉到 `mcpp.platform.env`(路径列表组合的所在地),并让 `prepend_path_list` 只清洗**继承来的尾部**:调用方显式传入的 payload 目录必须保留 —— 那正是沙箱二进制需要的那一条。PATH 不受影响。
+
+  这个缺陷与 #311 无关,是排查 e2e 156 在本 PR 上失败时找出来的:两次 CI 恢复了**不同的 sandbox 缓存**(`…-01baa227…` vs `…-0e74cc64…`),payload 版本集不同,于是同一个潜伏缺陷只在一侧显形。本改动前该测试的绿灯取决于「毒化的 payload 版本恰好与工具期望的一致」。
+
+
 ### 变更
 
 - **BMI 缓存根统一为 `$MCPP_HOME/bmi`。** `toolchain/stdmod.cppm` 的 `default_cache_root()` 是 home 解析逻辑的一份私有拷贝,自 v0.0.1 起一字未改:**没有 Windows 的 `USERPROFILE` 分支,也没有 self-contained 安装探测**。后果是 Windows PowerShell(不设 `HOME`)下 std BMI 缓存落进**当前工作目录**的 `.mcpp-bmi/`,而 dep BMI 缓存在 `%USERPROFILE%\.mcpp\bmi` —— 一个缓存两个根,其中一个还随 cwd 漂移(从子目录跑就重编一次 std);release tarball 形态的安装在 Linux 上同样分家。

src/platform/env.cppm

@@ -41,6 +41,24 @@ private:
 std::string path_list_separator();
 std::string runtime_library_path_key();
 std::string host_tool_runtime_library_path_key();
+
+// Drop mcpp's private-glibc payload entries from a loader search path.
+//
+// An outer `mcpp run`/`mcpp test` points LD_LIBRARY_PATH at the payload so ITS
+// child (a sandbox-linked binary) can load. Anything further down the process
+// tree that is a HOST binary — /bin/sh, or a payload tool patched against a
+// DIFFERENT payload version — then resolves a mismatched libc.so.6 against the
+// host ld.so and dies inside the dynamic linker before main (signature: a bare
+// `__vdso_time` line, then SIGSEGV). libc and ld.so are version-locked through
+// GLIBC_PRIVATE, so this never reproduces when the two happen to match.
+//
+// Lives here, next to path-list composition, because BOTH consumers need the
+// same predicate: process.cppm sanitizes the INHERITED variable for every child,
+// and prepend_path_list sanitizes the inherited TAIL it carries into a composed
+// override (dirs the caller passed explicitly are always kept — that is the
+// entry the sandbox binary actually needs).
+std::string strip_private_glibc(std::string_view paths);
+
 std::string prepend_path_list(std::string_view key,
                               std::span<const std::filesystem::path> dirs);
 
@@ -134,6 +152,25 @@ std::string host_tool_runtime_library_path_key() {
 #endif
 }
 
+std::string strip_private_glibc(std::string_view paths) {
+    auto sep = path_list_separator();
+    std::string cleaned;
+    std::size_t start = 0;
+    while (start <= paths.size()) {
+        auto end = paths.find(sep, start);
+        if (end == std::string_view::npos) end = paths.size();
+        auto item = paths.substr(start, end - start);
+        if (!item.empty() && item.find("/xim-x-glibc/") == std::string_view::npos
+                          && item.find("\\xim-x-glibc\\") == std::string_view::npos) {
+            if (!cleaned.empty()) cleaned += sep;
+            cleaned += item;
+        }
+        if (end == paths.size()) break;
+        start = end + sep.size();
+    }
+    return cleaned;
+}
+
 std::string prepend_path_list(std::string_view key,
                               std::span<const std::filesystem::path> dirs) {
     if (key.empty() || dirs.empty()) return "";
@@ -149,8 +186,19 @@ std::string prepend_path_list(std::string_view key,
 
     std::string k(key);
     if (auto* existing = std::getenv(k.c_str()); existing && *existing) {
-        value += sep;
-        value += existing;
+        // Loader paths only: the inherited value may carry an OUTER mcpp's
+        // private-glibc entry, and the composed string becomes an EXPLICIT
+        // override — which process.cppm's merged_environ takes verbatim,
+        // skipping the sanitation it applies to inherited variables. Without
+        // this the strip is defeated exactly when it matters (a nested
+        // `mcpp run` → `mcpp test` chain), and the child tool segfaults in the
+        // dynamic linker whenever the payload versions differ.
+        std::string tail = (k == "LD_LIBRARY_PATH" || k == "DYLD_LIBRARY_PATH")
+            ? strip_private_glibc(existing) : std::string(existing);
+        if (!tail.empty()) {
+            value += sep;
+            value += tail;
+        }
     }
     return value;
 }

src/platform/process.cppm

@@ -188,22 +188,12 @@ char** host_environ() {
 // `__vdso_time` line). Strip exactly the private-glibc payload entries from
 // inherited loader paths: user-supplied entries survive, and an `extra`
 // override (the correct per-child value) always wins over the inherited var.
-std::string strip_private_glibc(std::string_view paths) {
-    std::string cleaned;
-    std::size_t start = 0;
-    while (start <= paths.size()) {
-        auto end = paths.find(':', start);
-        if (end == std::string_view::npos) end = paths.size();
-        auto item = paths.substr(start, end - start);
-        if (!item.empty() && item.find("/xim-x-glibc/") == std::string_view::npos) {
-            if (!cleaned.empty()) cleaned += ':';
-            cleaned += item;
-        }
-        if (end == paths.size()) break;
-        start = end + 1;
-    }
-    return cleaned;
-}
+//
+// The predicate itself lives in mcpp.platform.env, because the OTHER half of
+// this guarantee is there: a composed override (dirs + inherited tail) arrives
+// here as `extra` and therefore bypasses the sanitation below, so
+// prepend_path_list has to sanitize the tail it carries.
+using mcpp::platform::env::strip_private_glibc;
 
 // Build a child environment block = the current environ with `extra` overrides
 // applied. Returned vector owns the strings; the caller derives a NUL-terminated

tests/unit/test_platform_env.cpp

@@ -0,0 +1,102 @@
+#include <gtest/gtest.h>
+#include <cstdlib>
+
+import std;
+import mcpp.platform.env;
+
+namespace {
+
+class ScopedVar {
+public:
+    ScopedVar(std::string name, const char* value) : name_(std::move(name)) {
+        if (const char* old = std::getenv(name_.c_str()); old) { had_ = true; old_ = old; }
+        apply(value);
+    }
+    ~ScopedVar() { apply(had_ ? old_.c_str() : nullptr); }
+    ScopedVar(const ScopedVar&) = delete;
+    ScopedVar& operator=(const ScopedVar&) = delete;
+private:
+    void apply(const char* v) {
+#if defined(_WIN32)
+        ::_putenv_s(name_.c_str(), v ? v : "");
+#else
+        if (v) ::setenv(name_.c_str(), v, 1); else ::unsetenv(name_.c_str());
+#endif
+    }
+    std::string name_;
+    bool had_ = false;
+    std::string old_;
+};
+
+std::string sep() { return mcpp::platform::env::path_list_separator(); }
+
+std::string join(std::initializer_list<std::string_view> parts) {
+    std::string out;
+    for (auto p : parts) {
+        if (!out.empty()) out += sep();
+        out += p;
+    }
+    return out;
+}
+
+}  // namespace
+
+TEST(PlatformEnv, StripPrivateGlibcDropsOnlyPayloadEntries) {
+    auto in = join({"/usr/lib", "/home/u/.mcpp/registry/data/xpkgs/xim-x-glibc/2.39/lib64",
+                    "/opt/mine"});
+    EXPECT_EQ(mcpp::platform::env::strip_private_glibc(in),
+              join({"/usr/lib", "/opt/mine"}));
+}
+
+TEST(PlatformEnv, StripPrivateGlibcCanEmptyTheList) {
+    EXPECT_EQ(mcpp::platform::env::strip_private_glibc(
+                  "/x/xpkgs/xim-x-glibc/2.42/lib64"), "");
+    EXPECT_EQ(mcpp::platform::env::strip_private_glibc(""), "");
+}
+
+// The regression this guards (mcpp#311 investigation): the composed value
+// becomes an EXPLICIT override, and process.cppm's merged_environ takes explicit
+// overrides verbatim — skipping the sanitation it applies to inherited
+// variables. So if the inherited tail carried an outer `mcpp run`'s private
+// glibc, it reached the child anyway and a payload tool patched against a
+// DIFFERENT glibc segfaulted in the dynamic linker. Sanitizing here is what
+// makes process.cppm's guarantee actually hold one hop down.
+TEST(PlatformEnv, PrependPathListSanitizesTheInheritedLoaderTail) {
+    auto inherited = join({"/first",
+                           "/home/u/.mcpp/registry/data/xpkgs/xim-x-glibc/2.39/lib64",
+                           "/last"});
+    ScopedVar ld("LD_LIBRARY_PATH", inherited.c_str());
+
+    std::vector<std::filesystem::path> dirs{"/payload/lib"};
+    EXPECT_EQ(mcpp::platform::env::prepend_path_list("LD_LIBRARY_PATH", dirs),
+              join({"/payload/lib", "/first", "/last"}));
+}
+
+// A payload dir the CALLER passed is the entry the sandbox binary needs — it
+// must survive even though it matches the same pattern.
+TEST(PlatformEnv, PrependPathListKeepsExplicitPayloadDirs) {
+    ScopedVar ld("LD_LIBRARY_PATH", "/home/u/.mcpp/registry/data/xpkgs/xim-x-glibc/2.39/lib64");
+
+    std::vector<std::filesystem::path> dirs{
+        "/home/u/.mcpp/registry/data/xpkgs/xim-x-glibc/2.42/lib64"};
+    // Explicit dir kept, inherited (older, mismatched) entry dropped.
+    EXPECT_EQ(mcpp::platform::env::prepend_path_list("LD_LIBRARY_PATH", dirs),
+              "/home/u/.mcpp/registry/data/xpkgs/xim-x-glibc/2.42/lib64");
+}
+
+// PATH is not a loader search path: leave its inherited value alone.
+TEST(PlatformEnv, PrependPathListLeavesPathUntouched) {
+    auto inherited = join({"/bin", "/x/xpkgs/xim-x-glibc/2.39/lib64"});
+    ScopedVar path("PATH", inherited.c_str());
+
+    std::vector<std::filesystem::path> dirs{"/tools/bin"};
+    EXPECT_EQ(mcpp::platform::env::prepend_path_list("PATH", dirs),
+              join({"/tools/bin", "/bin", "/x/xpkgs/xim-x-glibc/2.39/lib64"}));
+}
+
+TEST(PlatformEnv, PrependPathListWithNoInheritedValueIsJustTheDirs) {
+    ScopedVar ld("LD_LIBRARY_PATH", nullptr);
+    std::vector<std::filesystem::path> dirs{"/a", "/b"};
+    EXPECT_EQ(mcpp::platform::env::prepend_path_list("LD_LIBRARY_PATH", dirs),
+              join({"/a", "/b"}));
+}