This is a wider reaching version of #8425

In the linked issue I did some investigation around default PATH variables for actions that at the time I thought only affected py_* targets but it turns out that many other actions on darwin do not inherit any PATH and therefore fallback to macOS's default shell env of /usr/gnu/bin:/usr/local/bin:/bin:/usr/bin:. which can allow leakage of /usr/local/* binaries (which is specifically an issue because of homebrew).

While the default PATH may be ok for some use cases, if you actually try to restrict it using --action_env=PATH=something or by executing bazel with env -i PATH=something bazel ..., neither of these are applied to these actions.

For example any action that is executed in the context of Xcode is executed with these environment variables:

  exec env - \
    APPLE_SDK_PLATFORM=MacOSX \
    APPLE_SDK_VERSION_OVERRIDE=10.15 \
    XCODE_VERSION_OVERRIDE=11.5.0.11E608c \
  external/local_config_cc/wrapped_clang ...

Some actions that don't require Xcode are executed with no environment variables:

  exec env - \
  bazel-out/host/bin/external/build_bazel_rules_apple/tools/bundletool/bundletool ...

This is not the behavior of some other rules like genrule where if you build this target with --action_env=/usr/bin:/bin it hits the "Valid path":

genrule(
    name = "foo",
    outs = ["foo.txt"],
    cmd = """
if [[ "$$PATH" != "/usr/bin:/bin" ]]; then
  echo "error: path not propagated: $$PATH"
  exit 1
else
  echo "Valid path! $$PATH"
  exit 1
fi
""",
)

I think that either all actions should get a very conservative default PATH like /usr/bin:/bin, or the flags like --action_env should be able to add env vars to these actions (I believe the latter is likely the more flexible path, but I'm not sure about the implementation implications).

For native actions it seems that this can be resolved by adding:

.setInheritedEnvironment(ImmutableSet.of("PATH"));

to this logic

But for starlark actions they inherit this environment:

When accessing the environment variables for an action with the cc_common api. There doesn't seem to be a way to craft an env_entry that doesn't impose a value. So I could add /usr/bin:/bin there, but it wouldn't allow overrides via --action_env=PATH=foo

I'm happy to make a change here but I'm hoping for some guidance on the right path!

What operating system are you running Bazel on?

macOS

Bazel version?

8f67892