`std::env` uses `getenv` instead of `secure_getenv`

[briansmith]

The glibc manual at https://www.gnu.org/software/libc/manual/html_node/Environment-Access.html#Environment-Access says:

Libraries should use secure_getenv instead of getenv, so that they do not accidentally use untrusted environment variables.

libstd is a library, and many (most?) Rust crates are libraries, so it seems like we either should follow glibc's advice and use secure_getenv, or we should document a clear rationale for going against its advice.

See

rust/library/std/src/sys/unix/os.rs

Line 533 in 1d71ba8

let s = libc::getenv(k.as_ptr()) as *const libc::c_char;

musl 1.1.24+ and glibc 2.17+ both support secure_getenv so I suggest we just assume any libc on Linux has it.

[est31]

The difference is explained in the linked doc:

This function is similar to getenv, but it returns a null pointer if the environment is untrusted. This happens when the program file has SUID or SGID bits set. General-purpose libraries should always prefer this function over getenv to avoid vulnerabilities if the library is referenced from a SUID/SGID program.

I think that concern is legitimate.