fix(runtime): keep the private libc out of the process environment (#401)

`mcpp run` put the private glibc directory on LD_LIBRARY_PATH. That
variable is inherited by every process the program ever spawns, and a
child like /bin/sh is loaded by the HOST loader — PT_INTERP is baked in
and no environment variable overrides it. glibc's libc.so.6 and its
ld.so are version-locked through GLIBC_PRIVATE, so the child dies during
relocation, before main:

  sh: symbol lookup error: …/xim-x-glibc/2.44/lib64/libc.so.6:
      undefined symbol: __pointer_chk_guard, version GLIBC_PRIVATE

The reporter hit it through an application probing the desktop theme
with gsettings: popen() returned nothing, the app silently used the
wrong theme, and mcpp said nothing. Verified locally — the 2.44 payload
kills /bin/sh, the 2.39 payload does not, which is why this survived as
long as it did and why "it works here" proved nothing.

The directory was published to serve a dlopen() the executable's
DT_NEEDED closure does not cover, and the artifact's RUNPATH already
covers exactly that: the link model emits -Wl,-rpath,<glibc> next to
--dynamic-linker, and the built binary's RUNPATH is byte-identical
before and after this change. So the environment entry bought nothing
and cost every child process. It is gone.

Measured against the released mcpp with the same fixture:
  before  LDLP=[…/runtime:…/xim-x-glibc/2.39/lib64]
  after   LDLP=[…/runtime]

The decision lives in mcpp.platform.runtime_env_contract as a scope,
not a condition: no build-level predicate can make an inherited variable
safe for a process mcpp did not launch and cannot see. mcpp#291 was the
same mistake one hop closer in.

208 pins all three halves — the dir is in the artifact RUNPATH, it is
not in the program's environment, and both the /bin/sh child and the
dlopen still work. The RUNPATH assertion deliberately checks coverage
mcpp does not itself emit, so losing it is a red test rather than a
silent loss of resolution.

Author: speak-agent

src/build/flags.cppm

@@ -804,6 +804,14 @@ CompileFlags compute_flags(const BuildPlan& plan) {
         // Dependency/runtime provider search comes from LinkIntent and is
         // rendered separately.  In particular runtimeSearchDirs contributes
         // RUNPATH only; it must never become a link-time -L path.
+        //
+        // The private libc directory is NOT emitted here: the link model
+        // already puts it in the artifact's RUNPATH wherever a payload exists
+        // (`-L<glibc> -Wl,-rpath,<glibc>` next to --dynamic-linker), and this
+        // link line has a hard 128KiB ceiling that real workspaces already
+        // spend 43% of. `208_private_libc_stays_in_the_binary.sh` asserts that
+        // coverage, so if a toolchain ever stops providing it the failure is a
+        // red test rather than a silent loss of dlopen() resolution.
     }
 
     // For Clang with payload paths: the payload C runtime — -B so the driver

src/build/plan.cppm

@@ -16,6 +16,7 @@ import mcpp.toolchain.fingerprint;
 import mcpp.toolchain.triple;
 import mcpp.platform;
 import mcpp.platform.runtime_binding;
+import mcpp.platform.runtime_env_contract;
 import mcpp.xlings.subos_info;
 
 export namespace mcpp::build {
@@ -887,29 +888,36 @@ make_plan(const mcpp::manifest::Manifest&         manifest,
     for (auto const& dir : tc.linkRuntimeDirs) {
         append_unique_path(plan.runtimeLibraryDirs, dir);
     }
-    // The private glibc payload is the ONE entry that is not also in the
-    // executable's RUNPATH (flags.cppm excludes it deliberately, so static and
-    // musl links stay clean). It is here purely so a dlopen()'d library — whose
-    // own DT_NEEDED closure never consults the main executable's RUNPATH — can
-    // still resolve the same libc the executable was linked against.
+    // The private glibc payload exists here for ONE reason: a dlopen()'d
+    // library, whose own DT_NEEDED closure never consults the main
+    // executable's RUNPATH, must still resolve the same libc the executable
+    // was linked against. So it is only published when this build actually has
+    // such a library.
     //
-    // So add it ONLY when this build actually has such a library. mcpp#291:
+    // It is published through the ARTIFACT — the link model already emits
+    // `-Wl,-rpath,<glibc>` alongside --dynamic-linker wherever a payload
+    // exists — and never through the environment.
     // LD_LIBRARY_PATH is inherited by the whole process subtree, and a child
-    // that is a HOST binary (/bin/sh, reached via a provider's popen()) loads
-    // the HOST loader — PT_INTERP is baked into the executable and no
-    // environment variable can override it — while this variable hands it the
-    // payload libc.so.6. libc and ld.so are version-locked to each other
-    // through GLIBC_PRIVATE, so on any host whose glibc differs from the
-    // payload's the shell dies of SIGSEGV inside the dynamic linker, before
-    // main, with empty stdout and no diagnostic. (It does NOT reproduce when
-    // host and payload glibc happen to match, which is why this survived.)
+    // that is a HOST binary (/bin/sh, reached via popen()) loads the HOST
+    // loader — PT_INTERP is baked in and no environment variable overrides it
+    // — while the variable hands it the payload libc.so.6. libc and ld.so are
+    // version-locked through GLIBC_PRIVATE, so the shell dies during
+    // relocation, before main: glibc 2.44's libc.so.6 needs
+    // `__pointer_chk_guard` from its own loader (mcpp#401), and older payloads
+    // segfault in the linker instead (mcpp#291). It does NOT reproduce when
+    // host and payload glibc happen to match, which is how it survived.
     //
     // process.cppm's strip_private_glibc already removes this entry from
-    // mcpp's OWN children. It cannot help one hop further out: mcpp sets the
-    // variable for the target deliberately, and what the target then spawns is
-    // beyond mcpp's reach. Not emitting it unless it is needed is.
-    if (tc.payloadPaths && !plan.depRuntimeLibraryDirs.empty()) {
-        append_unique_path(plan.runtimeLibraryDirs, tc.payloadPaths->glibcLib);
+    // mcpp's OWN children. It cannot help one hop further out — what the
+    // target spawns is beyond mcpp's reach. Putting the directory in the
+    // artifact's RUNPATH instead is: DT_RUNPATH reaches the object that
+    // carries it and the dlopen() it performs, and nothing else.
+    if constexpr (mcpp::platform::publishes_via_environment(
+                      mcpp::platform::kPrivateLibcSearchScope)) {
+        if (tc.payloadPaths && !plan.depRuntimeLibraryDirs.empty()) {
+            append_unique_path(plan.runtimeLibraryDirs,
+                               tc.payloadPaths->glibcLib);
+        }
     }
 
     // 1a. Object addressing.

src/platform/runtime_env_contract.cppm

@@ -0,0 +1,69 @@
+// mcpp.platform.runtime_env_contract — where a runtime search directory is
+// allowed to be published.
+//
+// There are two ways to tell a dynamic loader where to look, and they have
+// very different blast radii:
+//
+//   DT_RUNPATH        baked into ONE object. Reaches that object's own
+//                     DT_NEEDED closure and any dlopen() it performs. Nothing
+//                     else on the machine can observe it.
+//
+//   LD_LIBRARY_PATH   an environment variable. Reaches the target process AND
+//                     every process it ever spawns, transitively, forever —
+//                     including binaries mcpp never built, loaded by a loader
+//                     mcpp never chose.
+//
+// That second property is not a detail. mcpp ships a PRIVATE glibc, and a
+// glibc's `libc.so.6` and its `ld.so` are version-locked to each other through
+// GLIBC_PRIVATE symbols: 2.44's libc.so.6 carries an undefined reference to
+// `__pointer_chk_guard`, which only 2.44's own `ld-linux-x86-64.so.2` exports.
+// An mcpp-built program is fine — its PT_INTERP names the private loader. But
+// a program that calls popen()/system() spawns `/bin/sh`, whose PT_INTERP
+// names the HOST loader and cannot be overridden by any environment variable.
+// If LD_LIBRARY_PATH points that host loader at the private libc, the shell
+// dies during relocation, before main:
+//
+//   sh: symbol lookup error: …/xim-x-glibc/2.44/lib64/libc.so.6:
+//       undefined symbol: __pointer_chk_guard, version GLIBC_PRIVATE
+//
+// mcpp#401. The same shape, one hop closer in, was mcpp#291 (a nested mcpp's
+// own host tools). Both are the same mistake: publishing a private-libc search
+// path through a channel that does not stop at the process that needs it.
+//
+// So the rule is scoped, not conditional — "only export it when a dependency
+// might dlopen" still exports it, and the failing child does not care why. A
+// private libc directory is BINARY-scoped: it is written into the artifacts
+// mcpp itself links, and never into the environment. dlopen() from the program
+// still resolves, because the loader consults the calling object's DT_RUNPATH.
+//
+// Note the asymmetry with ordinary dependency runtime directories: those are
+// plain shared libraries with no loader coupling, so a host binary that
+// stumbles onto them is at worst confused, not killed. They keep their
+// existing environment scope.
+
+export module mcpp.platform.runtime_env_contract;
+
+import std;
+
+export namespace mcpp::platform {
+
+enum class RuntimeSearchScope {
+    Binary,       // DT_RUNPATH on the objects mcpp links
+    Environment,  // LD_LIBRARY_PATH, inherited by the whole process subtree
+};
+
+// The private libc payload. See the module comment for why this is not a
+// tunable: no build-level condition can make an inherited variable safe for a
+// process that mcpp did not launch and cannot see.
+inline constexpr RuntimeSearchScope kPrivateLibcSearchScope =
+    RuntimeSearchScope::Binary;
+
+constexpr bool publishes_via_environment(RuntimeSearchScope scope) {
+    return scope == RuntimeSearchScope::Environment;
+}
+
+constexpr bool publishes_via_binary(RuntimeSearchScope scope) {
+    return scope == RuntimeSearchScope::Binary;
+}
+
+} // namespace mcpp::platform

tests/e2e/208_private_libc_stays_in_the_binary.sh

@@ -0,0 +1,148 @@
+#!/usr/bin/env bash
+# requires: gcc elf unix-shell
+# 208_private_libc_stays_in_the_binary.sh — mcpp#401.
+#
+# mcpp ships a private glibc. Its libc.so.6 and its ld.so are version-locked to
+# each other through GLIBC_PRIVATE symbols — glibc 2.44's libc.so.6 carries an
+# undefined reference to `__pointer_chk_guard`, exported only by 2.44's own
+# loader. An mcpp-built program is unaffected: PT_INTERP names the private
+# loader. `/bin/sh` is not: its PT_INTERP names the HOST loader, and no
+# environment variable can override it.
+#
+# So the moment the private libc directory reaches LD_LIBRARY_PATH — which is
+# inherited by every process the program ever spawns — any popen()/system() in
+# the program dies during relocation, before main:
+#
+#   sh: symbol lookup error: …/xim-x-glibc/2.44/lib64/libc.so.6:
+#       undefined symbol: __pointer_chk_guard, version GLIBC_PRIVATE
+#
+# The reporter hit it through an application probing the desktop theme with
+# `gsettings`: the child never ran, popen() returned nothing, and the app
+# silently used the wrong theme. Nothing in the mcpp output said anything.
+#
+# The directory is still needed — a dlopen()'d library's own DT_NEEDED closure
+# does not consult the executable's RUNPATH — so it is published through the
+# ARTIFACT (DT_RUNPATH, which reaches exactly the object carrying it) instead
+# of the ENVIRONMENT. This test pins both halves: the child survives, and the
+# library still loads.
+set -e
+
+TMP=$(mktemp -d)
+trap 'rm -rf "$TMP"' EXIT
+
+cd "$TMP"
+mkdir -p app/src app/runtime
+
+# A dlopen-only plugin. Its presence is what makes mcpp publish the private
+# libc directory at all, so the test would not exercise the bug without it.
+cat > app/runtime/plugin.c <<'EOF'
+int runtime_plugin_answer(void) { return 42; }
+EOF
+gcc -shared -fPIC app/runtime/plugin.c -o app/runtime/libruntime_plugin.so
+
+cat > app/src/main.cpp <<'EOF'
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <dlfcn.h>
+
+using answer_fn = int (*)();
+
+int main() {
+    // 1. What the program was handed. Printed so the test can assert on the
+    //    real environment rather than on how it was constructed.
+    const char* ldlp = std::getenv("LD_LIBRARY_PATH");
+    std::printf("LDLP=[%s]\n", ldlp ? ldlp : "");
+
+    // 2. A child that the HOST loader loads. This is the #401 failure.
+    std::FILE* pipe = ::popen("/bin/sh -c 'echo mcpp-child-ok'", "r");
+    if (!pipe) { std::puts("CHILD=popen-failed"); return 10; }
+    char buf[64] = {0};
+    const bool got = std::fgets(buf, sizeof buf, pipe) != nullptr;
+    const int status = ::pclose(pipe);
+    buf[strcspn(buf, "\n")] = '\0';
+    std::printf("CHILD=[%s] status=%d\n", got ? buf : "", status);
+    if (!got || std::strcmp(buf, "mcpp-child-ok") != 0) return 11;
+
+    // 3. …and the dlopen the private libc directory exists to serve must still
+    //    work, or the fix traded one breakage for another.
+    void* handle = ::dlopen("libruntime_plugin.so", RTLD_NOW);
+    if (!handle) { std::printf("DLOPEN=[%s]\n", ::dlerror()); return 12; }
+    auto answer = reinterpret_cast<answer_fn>(
+        ::dlsym(handle, "runtime_plugin_answer"));
+    const int value = answer ? answer() : -1;
+    ::dlclose(handle);
+    std::printf("DLOPEN=ok answer=%d\n", value);
+    return value == 42 ? 0 : 13;
+}
+EOF
+
+cat > app/mcpp.toml <<'EOF'
+[package]
+name    = "app"
+version = "0.1.0"
+
+[build]
+sources = ["src/*.cpp"]
+ldflags = ["-ldl"]
+
+[runtime]
+library_dirs = ["runtime"]
+
+[targets.app]
+kind = "bin"
+main = "src/main.cpp"
+EOF
+
+cd app
+"$MCPP" build > build.log 2>&1 || { cat build.log; echo "build failed"; exit 1; }
+
+NINJA=$(find target -name build.ninja | head -1)
+GLIBC_LIB=$(grep -oE '/[^ ",]*/xim-x-glibc/[0-9.]+/lib(64)?' "$NINJA" | head -1 || true)
+if [[ -z "$GLIBC_LIB" ]]; then
+    echo "SKIP: this toolchain has no private glibc payload"
+    exit 0
+fi
+echo "private libc payload: $GLIBC_LIB"
+
+# ── 1. published through the artifact ───────────────────────────────
+# The link model emits this next to --dynamic-linker. mcpp does not add a
+# second copy — the link line has a hard 128KiB ceiling — so this asserts the
+# coverage it relies on instead of duplicating it. If a toolchain ever stops
+# providing it, dlopen() resolution would silently lose the payload libc, and
+# this is the test that says so.
+grep -F -- "-Wl,-rpath,$GLIBC_LIB" "$NINJA" >/dev/null || {
+    echo "FAIL: private libc directory is not in the artifact RUNPATH"
+    grep -nF -- "$GLIBC_LIB" "$NINJA" || true
+    exit 1
+}
+
+run_out=$("$MCPP" run 2>&1) || { echo "$run_out"; echo "run failed"; exit 1; }
+
+# ── 2. the program's own environment must not carry it ──────────────
+ldlp_line=$(printf '%s\n' "$run_out" | grep '^LDLP=' || true)
+[[ -n "$ldlp_line" ]] || { echo "$run_out"; echo "FAIL: program printed no LD_LIBRARY_PATH"; exit 1; }
+case "$ldlp_line" in
+    *"$GLIBC_LIB"*)
+        echo "$ldlp_line"
+        echo "FAIL: private libc directory reached LD_LIBRARY_PATH — every child"
+        echo "      process the program spawns now loads it under the host loader"
+        exit 1
+        ;;
+esac
+
+# ── 3. the child the host loader loads must survive ─────────────────
+printf '%s\n' "$run_out" | grep -q 'CHILD=\[mcpp-child-ok\] status=0' || {
+    echo "$run_out"
+    echo "FAIL: a /bin/sh child did not run cleanly under mcpp run (mcpp#401)"
+    exit 1
+}
+
+# ── 4. …and the dlopen it exists for still resolves ─────────────────
+printf '%s\n' "$run_out" | grep -q 'DLOPEN=ok answer=42' || {
+    echo "$run_out"
+    echo "FAIL: dlopen through the runtime library dir regressed"
+    exit 1
+}
+
+echo "OK"