diff --git a/linker/Android.mk b/linker/Android.mk
index 503da86..e3ac7e9 100644
--- a/linker/Android.mk
+++ b/linker/Android.mk
@@ -3,20 +3,19 @@
 
 LOCAL_SRC_FILES:= \
 	arch/$(TARGET_ARCH)/begin.S \
-	debugger.c \
+	debugger.cpp \
 	dlfcn.cpp \
 	linker.cpp \
-	linker_environ.c \
-	linker_format.c \
-	linker_phdr.c \
-	rt.c
+	linker_environ.cpp \
+	linker_format.cpp \
+	linker_phdr.cpp \
+	rt.cpp
 
 LOCAL_LDFLAGS := -shared
 
 LOCAL_CFLAGS += -fno-stack-protector \
         -Wstrict-overflow=5 \
         -fvisibility=hidden \
-        -std=gnu99 \
         -Wall -Wextra
 
 # Set LINKER_DEBUG to either 1 or 0
diff --git a/linker/debugger.c b/linker/debugger.cpp
similarity index 84%
rename from linker/debugger.c
rename to linker/debugger.cpp
index e4d4ae9..bba89b8 100644
--- a/linker/debugger.c
+++ b/linker/debugger.cpp
@@ -26,6 +26,9 @@
  * SUCH DAMAGE.
  */
 
+#include "linker.h"
+#include "linker_format.h"
+
 #include <stdio.h>
 #include <stdlib.h>
 #include <unistd.h>
@@ -36,45 +39,35 @@
 #include <sys/socket.h>
 #include <sys/un.h>
 
-extern int tgkill(int tgid, int tid, int sig);
+#include <private/logd.h>
 
-void notify_gdb_of_libraries();
+extern "C" int tgkill(int tgid, int tid, int sig);
 
 #define DEBUGGER_SOCKET_NAME "android:debuggerd"
 
-typedef enum {
+enum debugger_action_t {
     // dump a crash
     DEBUGGER_ACTION_CRASH,
     // dump a tombstone file
     DEBUGGER_ACTION_DUMP_TOMBSTONE,
     // dump a backtrace only back to the socket
     DEBUGGER_ACTION_DUMP_BACKTRACE,
-} debugger_action_t;
+};
 
 /* message sent over the socket */
-typedef struct {
+struct debugger_msg_t {
     debugger_action_t action;
     pid_t tid;
-} debugger_msg_t;
-
-#define  RETRY_ON_EINTR(ret,cond) \
-    do { \
-        ret = (cond); \
-    } while (ret < 0 && errno == EINTR)
+};
 
 // see man(2) prctl, specifically the section about PR_GET_NAME
 #define MAX_TASK_NAME_LEN (16)
 
-static int socket_abstract_client(const char *name, int type)
-{
-    struct sockaddr_un addr;
-    size_t namelen;
-    socklen_t alen;
-    int s, err;
-
-    namelen  = strlen(name);
+static int socket_abstract_client(const char* name, int type) {
+    sockaddr_un addr;
 
     // Test with length +1 for the *initial* '\0'.
+    size_t namelen = strlen(name);
     if ((namelen + 1) > sizeof(addr.sun_path)) {
         errno = EINVAL;
         return -1;
@@ -86,18 +79,20 @@
      * Note: The path in this case is *not* supposed to be
      * '\0'-terminated. ("man 7 unix" for the gory details.)
      */
-    memset (&addr, 0, sizeof addr);
+    memset(&addr, 0, sizeof(addr));
     addr.sun_family = AF_LOCAL;
     addr.sun_path[0] = 0;
     memcpy(addr.sun_path + 1, name, namelen);
 
-    alen = namelen + offsetof(struct sockaddr_un, sun_path) + 1;
+    socklen_t alen = namelen + offsetof(sockaddr_un, sun_path) + 1;
 
-    s = socket(AF_LOCAL, type, 0);
-    if(s < 0) return -1;
+    int s = socket(AF_LOCAL, type, 0);
+    if (s == -1) {
+        return -1;
+    }
 
-    RETRY_ON_EINTR(err,connect(s, (struct sockaddr *) &addr, alen));
-    if (err < 0) {
+    int err = TEMP_FAILURE_RETRY(connect(s, (sockaddr*) &addr, alen));
+    if (err == -1) {
         close(s);
         s = -1;
     }
@@ -105,9 +100,6 @@
     return s;
 }
 
-#include "linker_format.h"
-#include <../libc/private/logd.h>
-
 /*
  * Writes a summary of the signal to the log file.  We do this so that, if
  * for some reason we're not able to contact debuggerd, there is still some
@@ -116,15 +108,9 @@
  * We could be here as a result of native heap corruption, or while a
  * mutex is being held, so we don't want to use any libc functions that
  * could allocate memory or hold a lock.
- *
- * "info" will be NULL if the siginfo_t information was not available.
  */
-static void logSignalSummary(int signum, const siginfo_t* info)
-{
-    char buffer[128];
-    char threadname[MAX_TASK_NAME_LEN + 1]; // one more for termination
-
-    char* signame;
+static void logSignalSummary(int signum, const siginfo_t* info) {
+    const char* signame;
     switch (signum) {
         case SIGILL:    signame = "SIGILL";     break;
         case SIGABRT:   signame = "SIGABRT";    break;
@@ -138,6 +124,7 @@
         default:        signame = "???";        break;
     }
 
+    char threadname[MAX_TASK_NAME_LEN + 1]; // one more for termination
     if (prctl(PR_GET_NAME, (unsigned long)threadname, 0, 0, 0) != 0) {
         strcpy(threadname, "<name unknown>");
     } else {
@@ -145,6 +132,9 @@
         // implies that 16 byte names are not.
         threadname[MAX_TASK_NAME_LEN] = 0;
     }
+
+    char buffer[128];
+    // "info" will be NULL if the siginfo_t information was not available.
     if (info != NULL) {
         format_buffer(buffer, sizeof(buffer),
             "Fatal signal %d (%s) at 0x%08x (code=%d), thread %d (%s)",
@@ -161,8 +151,7 @@
 /*
  * Returns true if the handler for signal "signum" has SA_SIGINFO set.
  */
-static bool haveSiginfo(int signum)
-{
+static bool haveSiginfo(int signum) {
     struct sigaction oldact, newact;
 
     memset(&newact, 0, sizeof(newact));
@@ -188,11 +177,8 @@
  * Catches fatal signals so we can ask debuggerd to ptrace us before
  * we crash.
  */
-void debugger_signal_handler(int n, siginfo_t* info, void* unused __attribute__((unused)))
-{
+void debugger_signal_handler(int n, siginfo_t* info, void*) {
     char msgbuf[128];
-    unsigned tid;
-    int s;
 
     /*
      * It's possible somebody cleared the SA_SIGINFO flag, which would mean
@@ -204,8 +190,8 @@
 
     logSignalSummary(n, info);
 
-    tid = gettid();
-    s = socket_abstract_client(DEBUGGER_SOCKET_NAME, SOCK_STREAM);
+    pid_t tid = gettid();
+    int s = socket_abstract_client(DEBUGGER_SOCKET_NAME, SOCK_STREAM);
 
     if (s >= 0) {
         /* debugger knows our pid from the credentials on the
@@ -217,14 +203,14 @@
         debugger_msg_t msg;
         msg.action = DEBUGGER_ACTION_CRASH;
         msg.tid = tid;
-        RETRY_ON_EINTR(ret, write(s, &msg, sizeof(msg)));
+        ret = TEMP_FAILURE_RETRY(write(s, &msg, sizeof(msg)));
         if (ret == sizeof(msg)) {
             /* if the write failed, there is no point to read on
              * the file descriptor. */
-            RETRY_ON_EINTR(ret, read(s, &tid, 1));
-            int savedErrno = errno;
+            ret = TEMP_FAILURE_RETRY(read(s, &tid, 1));
+            int saved_errno = errno;
             notify_gdb_of_libraries();
-            errno = savedErrno;
+            errno = saved_errno;
         }
 
         if (ret < 0) {
@@ -266,8 +252,7 @@
     }
 }
 
-void debugger_init()
-{
+void debugger_init() {
     struct sigaction act;
     memset(&act, 0, sizeof(act));
     act.sa_sigaction = debugger_signal_handler;
diff --git a/linker/linker.cpp b/linker/linker.cpp
index 4ffa1e7..4c52f3d 100644
--- a/linker/linker.cpp
+++ b/linker/linker.cpp
@@ -93,7 +93,6 @@
 static soinfo *somain; /* main process, always the one after libdl_info */
 #endif
 
-
 static char ldpaths_buf[LDPATH_BUFSIZE];
 static const char *ldpaths[LDPATH_MAX + 1];
 
@@ -108,9 +107,6 @@
 
 static int pid;
 
-/* This boolean is set if the program being loaded is setuid */
-static bool program_is_setuid;
-
 enum RelocationKind {
     kRelocAbsolute = 0,
     kRelocRelative,
@@ -257,8 +253,7 @@
     rtld_db_dlactivity();
 }
 
-extern "C" void notify_gdb_of_libraries()
-{
+void notify_gdb_of_libraries() {
     _r_debug.r_state = RT_ADD;
     rtld_db_dlactivity();
     _r_debug.r_state = RT_CONSISTENT;
@@ -1689,7 +1684,7 @@
     ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:23.stdio.asc
 
      */
-    if (program_is_setuid) {
+    if (get_AT_SECURE()) {
         nullify_closed_stdio();
     }
     notify_gdb_of_load(si);
@@ -1750,11 +1745,6 @@
     int argc = (int) *elfdata;
     char **argv = (char**) (elfdata + 1);
     unsigned *vecs = (unsigned*) (argv + argc + 1);
-    unsigned *v;
-    soinfo *si;
-    int i;
-    const char *ldpath_env = NULL;
-    const char *ldpreload_env = NULL;
 
     /* NOTE: we store the elfdata pointer on a special location
      *       of the temporary TLS area in order to pass it to
@@ -1773,53 +1763,36 @@
     gettimeofday(&t0, 0);
 #endif
 
-    /* Initialize environment functions, and get to the ELF aux vectors table */
+    // Initialize environment functions, and get to the ELF aux vectors table.
     vecs = linker_env_init(vecs);
 
-    /* Check auxv for AT_SECURE first to see if program is setuid, setgid,
-       has file caps, or caused a SELinux/AppArmor domain transition. */
-    for (v = vecs; v[0]; v += 2) {
-        if (v[0] == AT_SECURE) {
-            /* kernel told us whether to enable secure mode */
-            program_is_setuid = v[1];
-            goto sanitize;
-        }
-    }
-
-    /* Kernel did not provide AT_SECURE - fall back on legacy test. */
-    program_is_setuid = (getuid() != geteuid()) || (getgid() != getegid());
-
-sanitize:
-    /* Sanitize environment if we're loading a setuid program */
-    if (program_is_setuid) {
-        linker_env_secure();
-    }
-
     debugger_init();
 
-    /* Get a few environment variables */
-    {
+    // Get a few environment variables.
 #if LINKER_DEBUG
-        const char* env;
-        env = linker_env_get("DEBUG"); /* XXX: TODO: Change to LD_DEBUG */
-        if (env)
+    {
+        const char* env = linker_env_get("LD_DEBUG");
+        if (env != NULL) {
             debug_verbosity = atoi(env);
+        }
+    }
 #endif
 
-        /* Normally, these are cleaned by linker_env_secure, but the test
-         * against program_is_setuid doesn't cost us anything */
-        if (!program_is_setuid) {
-            ldpath_env = linker_env_get("LD_LIBRARY_PATH");
-            ldpreload_env = linker_env_get("LD_PRELOAD");
-        }
+    // Normally, these are cleaned by linker_env_init, but the test
+    // doesn't cost us anything.
+    const char* ldpath_env = NULL;
+    const char* ldpreload_env = NULL;
+    if (!get_AT_SECURE()) {
+      ldpath_env = linker_env_get("LD_LIBRARY_PATH");
+      ldpreload_env = linker_env_get("LD_PRELOAD");
     }
 
     INFO("[ android linker & debugger ]\n");
     DEBUG("%5d elfdata @ 0x%08x\n", pid, (unsigned)elfdata);
 
-    si = soinfo_alloc(argv[0]);
-    if(si == 0) {
-        exit(-1);
+    soinfo* si = soinfo_alloc(argv[0]);
+    if (si == NULL) {
+        exit(EXIT_FAILURE);
     }
 
     /* bootstrap the link map, the main exe always needs to be first */
@@ -1858,7 +1831,7 @@
     insert_soinfo_into_debug_map(&linker_soinfo);
 
     /* extract information passed from the kernel */
-    while(vecs[0] != 0){
+    while (vecs[0] != 0){
         switch(vecs[0]){
         case AT_PHDR:
             si->phdr = (Elf32_Phdr*) vecs[1];
@@ -1899,12 +1872,12 @@
         char errmsg[] = "CANNOT LINK EXECUTABLE\n";
         write(2, __linker_dl_err_buf, strlen(__linker_dl_err_buf));
         write(2, errmsg, sizeof(errmsg));
-        exit(-1);
+        exit(EXIT_FAILURE);
     }
 
     soinfo_call_preinit_constructors(si);
 
-    for(i = 0; preloads[i] != NULL; i++) {
+    for (size_t i = 0; preloads[i] != NULL; ++i) {
         soinfo_call_constructors(preloads[i]);
     }
 
@@ -2049,7 +2022,7 @@
         //
         // This situation should never occur unless the linker itself
         // is corrupt.
-        exit(-1);
+        exit(EXIT_FAILURE);
     }
 
     // We have successfully fixed our own relocations. It's safe to run
diff --git a/linker/linker.h b/linker/linker.h
index 8ed433c..54563bb 100644
--- a/linker/linker.h
+++ b/linker/linker.h
@@ -34,9 +34,6 @@
 #include <elf.h>
 #include <sys/exec_elf.h>
 
-#ifdef __cplusplus
-extern "C" {
-#endif
 #include <link.h>
 
 #undef PAGE_MASK
@@ -89,8 +86,6 @@
     uintptr_t r_ldbase;
 };
 
-typedef struct soinfo soinfo;
-
 #define FLAG_LINKED     0x00000001
 #define FLAG_ERROR      0x00000002
 #define FLAG_EXE        0x00000004 // The main executable
@@ -98,8 +93,7 @@
 
 #define SOINFO_NAME_LEN 128
 
-struct soinfo
-{
+struct soinfo {
     char name[SOINFO_NAME_LEN];
     const Elf32_Phdr *phdr;
     int phnum;
@@ -232,8 +226,6 @@
 Elf32_Sym *soinfo_lookup(soinfo *si, const char *name);
 void soinfo_call_constructors(soinfo *si);
 
-#ifdef __cplusplus
-};
-#endif
+extern "C" void notify_gdb_of_libraries();
 
 #endif
diff --git a/linker/linker_debug.h b/linker/linker_debug.h
index 48a7abf..b9dfe34 100644
--- a/linker/linker_debug.h
+++ b/linker/linker_debug.h
@@ -62,10 +62,6 @@
 #if LINKER_DEBUG
 #include "linker_format.h"
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
 extern int debug_verbosity;
 #if LINKER_DEBUG_TO_LOG
 extern int format_log(int, const char *, const char *, ...);
@@ -81,10 +77,6 @@
     } while (0)
 #endif /* !LINKER_DEBUG_TO_LOG */
 
-#ifdef __cplusplus
-};
-#endif
-
 #else /* !LINKER_DEBUG */
 #define _PRINTVF(v,f,x...)   do {} while(0)
 #endif /* LINKER_DEBUG */
diff --git a/linker/linker_environ.c b/linker/linker_environ.c
deleted file mode 100644
index fadcb60..0000000
--- a/linker/linker_environ.c
+++ /dev/null
@@ -1,202 +0,0 @@
-/*
- * Copyright (C) 2010 The Android Open Source Project
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
- * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
- * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
- * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
- * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
- * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-#include "linker_environ.h"
-#include <stddef.h>
-
-static char** _envp;
-
-/* Returns 1 if 'str' points to a valid environment variable definition.
- * For now, we check that:
- *  - It is smaller than MAX_ENV_LEN (to detect non-zero terminated strings)
- *  - It contains at least one equal sign that is not the first character
- */
-static int
-_is_valid_definition(const char*  str)
-{
-    int   pos = 0;
-    int   first_equal_pos = -1;
-
-    /* According to its sources, the kernel uses 32*PAGE_SIZE by default
-     * as the maximum size for an env. variable definition.
-     */
-    const int MAX_ENV_LEN = 32*4096;
-
-    if (str == NULL)
-        return 0;
-
-    /* Parse the string, looking for the first '=' there, and its size */
-    do {
-        if (str[pos] == '\0')
-            break;
-        if (str[pos] == '=' && first_equal_pos < 0)
-            first_equal_pos = pos;
-        pos++;
-    } while (pos < MAX_ENV_LEN);
-
-    if (pos >= MAX_ENV_LEN)  /* Too large */
-        return 0;
-
-    if (first_equal_pos < 1)  /* No equal sign, or it is the first character */
-        return 0;
-
-    return 1;
-}
-
-unsigned*
-linker_env_init(unsigned* vecs)
-{
-    /* Store environment pointer - can't be NULL */
-    _envp = (char**) vecs;
-
-    /* Skip over all definitions */
-    while (vecs[0] != 0)
-        vecs++;
-    /* The end of the environment block is marked by two NULL pointers */
-    vecs++;
-
-    /* As a sanity check, we're going to remove all invalid variable
-     * definitions from the environment array.
-     */
-    {
-        char** readp  = _envp;
-        char** writep = _envp;
-        for ( ; readp[0] != NULL; readp++ ) {
-            if (!_is_valid_definition(readp[0]))
-                continue;
-            writep[0] = readp[0];
-            writep++;
-        }
-        writep[0] = NULL;
-    }
-
-    /* Return the address of the aux vectors table */
-    return vecs;
-}
-
-/* Check if the environment variable definition at 'envstr'
- * starts with '<name>=', and if so return the address of the
- * first character after the equal sign. Otherwise return NULL.
- */
-static char*
-env_match(char* envstr, const char* name)
-{
-    size_t  cnt = 0;
-
-    while (envstr[cnt] == name[cnt] && name[cnt] != '\0')
-        cnt++;
-
-    if (name[cnt] == '\0' && envstr[cnt] == '=')
-        return envstr + cnt + 1;
-
-    return NULL;
-}
-
-#define MAX_ENV_LEN  (16*4096)
-
-const char*
-linker_env_get(const char* name)
-{
-    char** readp = _envp;
-
-    if (name == NULL || name[0] == '\0')
-        return NULL;
-
-    for ( ; readp[0] != NULL; readp++ ) {
-        char* val = env_match(readp[0], name);
-        if (val != NULL) {
-            /* Return NULL for empty strings, or if it is too large */
-            if (val[0] == '\0')
-                val = NULL;
-            return val;
-        }
-    }
-    return NULL;
-}
-
-
-void
-linker_env_unset(const char* name)
-{
-    char**  readp = _envp;
-    char**  writep = readp;
-
-    if (name == NULL || name[0] == '\0')
-        return;
-
-    for ( ; readp[0] != NULL; readp++ ) {
-        if (env_match(readp[0], name))
-            continue;
-        writep[0] = readp[0];
-        writep++;
-    }
-    /* end list with a NULL */
-    writep[0] = NULL;
-}
-
-
-
-/* Remove unsafe environment variables. This should be used when
- * running setuid programs. */
-void
-linker_env_secure(void)
-{
-    /* The same list than GLibc at this point */
-    static const char* const unsec_vars[] = {
-        "GCONV_PATH",
-        "GETCONF_DIR",
-        "HOSTALIASES",
-        "LD_AUDIT",
-        "LD_DEBUG",
-        "LD_DEBUG_OUTPUT",
-        "LD_DYNAMIC_WEAK",
-        "LD_LIBRARY_PATH",
-        "LD_ORIGIN_PATH",
-        "LD_PRELOAD",
-        "LD_PROFILE",
-        "LD_SHOW_AUXV",
-        "LD_USE_LOAD_BIAS",
-        "LOCALDOMAIN",
-        "LOCPATH",
-        "MALLOC_TRACE",
-        "MALLOC_CHECK_",
-        "NIS_PATH",
-        "NLSPATH",
-        "RESOLV_HOST_CONF",
-        "RES_OPTIONS",
-        "TMPDIR",
-        "TZDIR",
-        "LD_AOUT_LIBRARY_PATH",
-        "LD_AOUT_PRELOAD",
-        NULL
-    };
-
-    int count;
-    for (count = 0; unsec_vars[count] != NULL; count++) {
-        linker_env_unset(unsec_vars[count]);
-    }
-}
diff --git a/linker/linker_environ.cpp b/linker/linker_environ.cpp
new file mode 100644
index 0000000..357be6d
--- /dev/null
+++ b/linker/linker_environ.cpp
@@ -0,0 +1,222 @@
+/*
+ * Copyright (C) 2010 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "linker_environ.h"
+
+#include <linux/auxvec.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+static char** _envp;
+static bool _AT_SECURE_value = true;
+
+bool get_AT_SECURE() {
+  return _AT_SECURE_value;
+}
+
+/* Returns 1 if 'str' points to a valid environment variable definition.
+ * For now, we check that:
+ *  - It is smaller than MAX_ENV_LEN (to detect non-zero terminated strings)
+ *  - It contains at least one equal sign that is not the first character
+ */
+static int _is_valid_definition(const char* str) {
+  int pos = 0;
+  int first_equal_pos = -1;
+
+  // According to its sources, the kernel uses 32*PAGE_SIZE by default
+  // as the maximum size for an env. variable definition.
+  const int MAX_ENV_LEN = 32*4096;
+
+  if (str == NULL) {
+    return 0;
+  }
+
+  // Parse the string, looking for the first '=' there, and its size.
+  while (pos < MAX_ENV_LEN) {
+    if (str[pos] == '\0') {
+      break;
+    }
+    if (str[pos] == '=' && first_equal_pos < 0) {
+      first_equal_pos = pos;
+    }
+    pos++;
+  }
+
+  if (pos >= MAX_ENV_LEN) {
+    return 0; // Too large.
+  }
+
+  if (first_equal_pos < 1) {
+    return 0; // No equals sign, or it's the first character.
+  }
+
+  return 1;
+}
+
+static void __init_AT_SECURE(unsigned* auxv) {
+  // Check auxv for AT_SECURE first to see if program is setuid, setgid,
+  // has file caps, or caused a SELinux/AppArmor domain transition.
+  for (unsigned* v = auxv; v[0]; v += 2) {
+    if (v[0] == AT_SECURE) {
+      // Kernel told us whether to enable secure mode.
+      _AT_SECURE_value = v[1];
+      return;
+    }
+  }
+
+  // We don't support ancient kernels.
+  const char* msg = "FATAL: kernel did not supply AT_SECURE\n";
+  write(2, msg, strlen(msg));
+  exit(EXIT_FAILURE);
+}
+
+static void __remove_unsafe_environment_variables() {
+  // None of these should be allowed in setuid programs.
+  static const char* const UNSAFE_VARIABLE_NAMES[] = {
+      "GCONV_PATH",
+      "GETCONF_DIR",
+      "HOSTALIASES",
+      "LD_AOUT_LIBRARY_PATH",
+      "LD_AOUT_PRELOAD",
+      "LD_AUDIT",
+      "LD_DEBUG",
+      "LD_DEBUG_OUTPUT",
+      "LD_DYNAMIC_WEAK",
+      "LD_LIBRARY_PATH",
+      "LD_ORIGIN_PATH",
+      "LD_PRELOAD",
+      "LD_PROFILE",
+      "LD_SHOW_AUXV",
+      "LD_USE_LOAD_BIAS",
+      "LOCALDOMAIN",
+      "LOCPATH",
+      "MALLOC_CHECK_",
+      "MALLOC_TRACE",
+      "NIS_PATH",
+      "NLSPATH",
+      "RESOLV_HOST_CONF",
+      "RES_OPTIONS",
+      "TMPDIR",
+      "TZDIR",
+      NULL
+  };
+  for (size_t i = 0; UNSAFE_VARIABLE_NAMES[i] != NULL; ++i) {
+    linker_env_unset(UNSAFE_VARIABLE_NAMES[i]);
+  }
+}
+
+static void __remove_invalid_environment_variables() {
+  char** src  = _envp;
+  char** dst = _envp;
+  for (; src[0] != NULL; ++src) {
+    if (!_is_valid_definition(src[0])) {
+      continue;
+    }
+    dst[0] = src[0];
+    ++dst;
+  }
+  dst[0] = NULL;
+}
+
+unsigned* linker_env_init(unsigned* environment_and_aux_vectors) {
+  // Store environment pointer - can't be NULL.
+  _envp = reinterpret_cast<char**>(environment_and_aux_vectors);
+
+  // Skip over all environment variable definitions.
+  // The end of the environment block is marked by two NULL pointers.
+  unsigned* aux_vectors = environment_and_aux_vectors;
+  while (aux_vectors[0] != 0) {
+    ++aux_vectors;
+  }
+  ++aux_vectors;
+
+  __remove_invalid_environment_variables();
+  __init_AT_SECURE(aux_vectors);
+
+  // Sanitize environment if we're loading a setuid program.
+  if (get_AT_SECURE()) {
+    __remove_unsafe_environment_variables();
+  }
+
+  return aux_vectors;
+}
+
+/* Check if the environment variable definition at 'envstr'
+ * starts with '<name>=', and if so return the address of the
+ * first character after the equal sign. Otherwise return NULL.
+ */
+static char* env_match(char* envstr, const char* name) {
+  size_t i = 0;
+
+  while (envstr[i] == name[i] && name[i] != '\0') {
+    ++i;
+  }
+
+  if (name[i] == '\0' && envstr[i] == '=') {
+    return envstr + i + 1;
+  }
+
+  return NULL;
+}
+
+const char* linker_env_get(const char* name) {
+  if (name == NULL || name[0] == '\0') {
+    return NULL;
+  }
+
+  for (char** p = _envp; p[0] != NULL; ++p) {
+    char* val = env_match(p[0], name);
+    if (val != NULL) {
+      if (val[0] == '\0') {
+        return NULL; // Return NULL for empty strings.
+      }
+      return val;
+    }
+  }
+  return NULL;
+}
+
+void linker_env_unset(const char* name) {
+  char** readp = _envp;
+  char** writep = readp;
+
+  if (name == NULL || name[0] == '\0') {
+    return;
+  }
+
+  for ( ; readp[0] != NULL; readp++ ) {
+    if (env_match(readp[0], name)) {
+      continue;
+    }
+    writep[0] = readp[0];
+    writep++;
+  }
+  /* end list with a NULL */
+  writep[0] = NULL;
+}
diff --git a/linker/linker_environ.h b/linker/linker_environ.h
index d5f75a1..a0bd69f 100644
--- a/linker/linker_environ.h
+++ b/linker/linker_environ.h
@@ -25,38 +25,27 @@
  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
+
 #ifndef LINKER_ENVIRON_H
 #define LINKER_ENVIRON_H
 
-#ifdef __cplusplus
-extern "C" {
-#endif
+// Call this function before anything else. 'environment_and_aux_vectors'
+// must point to the environment block in the ELF data block. The function
+// returns the start of the aux vectors after the environment block.
+extern unsigned* linker_env_init(unsigned* environment_and_aux_vectors);
 
-/* Call this function before anything else. 'vecs' must be the pointer
- * to the environment block in the ELF data block. The function returns
- * the start of the aux vectors after the env block.
- */
-extern unsigned*   linker_env_init(unsigned* vecs);
+// Unset a given environment variable. In case the variable is defined
+// multiple times, unset all instances. This modifies the environment
+// block, so any pointer returned by linker_env_get() after this call
+// might become invalid.
+extern void linker_env_unset(const char* name);
 
-/* Unset a given environment variable. In case the variable is defined
- * multiple times, unset all instances. This modifies the environment
- * block, so any pointer returned by linker_env_get() after this call
- * might become invalid */
-extern void        linker_env_unset(const char* name);
-
-
-/* Returns the value of environment variable 'name' if defined and not
- * empty, or NULL otherwise. Note that the returned pointer may become
- * invalid if linker_env_unset() or linker_env_secure() are called
- * after this function. */
+// Returns the value of environment variable 'name' if defined and not
+// empty, or NULL otherwise. Note that the returned pointer may become
+// invalid if linker_env_unset() is called after this function.
 extern const char* linker_env_get(const char* name);
 
-/* Remove insecure environment variables. This should be used when
- * running setuid programs. */
-extern void        linker_env_secure(void);
-
-#ifdef __cplusplus
-};
-#endif
+// Returns the value of this program's AT_SECURE variable.
+extern bool get_AT_SECURE();
 
 #endif /* LINKER_ENVIRON_H */
diff --git a/linker/linker_format.c b/linker/linker_format.cpp
similarity index 95%
rename from linker/linker_format.c
rename to linker/linker_format.cpp
index f60e259..cc70a03 100644
--- a/linker/linker_format.c
+++ b/linker/linker_format.cpp
@@ -26,6 +26,7 @@
  * SUCH DAMAGE.
  */
 
+#include <assert.h>
 #include <stdarg.h>
 #include <string.h>
 #include <errno.h>
@@ -43,14 +44,12 @@
 /*** Generic output sink
  ***/
 
-typedef struct {
-    void *opaque;
-    void (*send)(void *opaque, const char *data, int len);
-} Out;
+struct Out {
+  void *opaque;
+  void (*send)(void *opaque, const char *data, int len);
+};
 
-static void
-out_send(Out *o, const void *data, size_t len)
-{
+static void out_send(Out *o, const char *data, size_t len) {
     o->send(o->opaque, data, (int)len);
 }
 
@@ -72,27 +71,25 @@
 }
 
 /* forward declaration */
-static void
-out_vformat(Out *o, const char *format, va_list args);
+static void out_vformat(Out* o, const char* format, va_list args);
 
 /*** Bounded buffer output
  ***/
 
-typedef struct {
-    Out out[1];
-    char *buffer;
-    char *pos;
-    char *end;
-    int total;
-} BufOut;
+struct BufOut {
+  Out out[1];
+  char *buffer;
+  char *pos;
+  char *end;
+  int total;
+};
 
-static void
-buf_out_send(void *opaque, const char *data, int len)
-{
-    BufOut *bo = opaque;
+static void buf_out_send(void *opaque, const char *data, int len) {
+    BufOut *bo = reinterpret_cast<BufOut*>(opaque);
 
-    if (len < 0)
+    if (len < 0) {
         len = strlen(data);
+    }
 
     bo->total += len;
 
@@ -194,11 +191,11 @@
 /*** File descriptor output
  ***/
 
-typedef struct {
-    Out out[1];
-    int fd;
-    int total;
-} FdOut;
+struct FdOut {
+  Out out[1];
+  int fd;
+  int total;
+};
 
 static void
 fd_out_send(void *opaque, const char *data, int len)
@@ -593,6 +590,10 @@
 
         slen = strlen(str);
 
+        if (sign != '\0' || prec != -1) {
+            __assert(__FILE__, __LINE__, "sign/precision unsupported");
+        }
+
         if (slen < width && !padLeft) {
             char padChar = padZero ? '0' : ' ';
             out_send_repeat(o, padChar, width - slen);
diff --git a/linker/linker_format.h b/linker/linker_format.h
index 3766b62..b8873c0 100644
--- a/linker/linker_format.h
+++ b/linker/linker_format.h
@@ -25,25 +25,17 @@
  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
+
 #ifndef _LINKER_FORMAT_H
 #define _LINKER_FORMAT_H
 
 #include <stdarg.h>
 #include <stddef.h>
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-/* Formatting routines for the dynamic linker's debug traces */
-/* We want to avoid dragging the whole C library fprintf()   */
-/* implementation into the dynamic linker since this creates */
-/* issues (it uses malloc()/free()) and increases code size  */
-
+// Formatting routines for the dynamic linker's debug traces
+// We want to avoid dragging the whole C library fprintf()
+// implementation into the dynamic linker since this creates
+// issues (it uses malloc()/free()) and increases code size.
 int format_buffer(char *buffer, size_t bufsize, const char *format, ...);
 
-#ifdef __cplusplus
-};
-#endif
-
 #endif /* _LINKER_FORMAT_H */
diff --git a/linker/linker_phdr.c b/linker/linker_phdr.cpp
similarity index 99%
rename from linker/linker_phdr.c
rename to linker/linker_phdr.cpp
index 250ca20..1990366 100644
--- a/linker/linker_phdr.c
+++ b/linker/linker_phdr.cpp
@@ -301,7 +301,6 @@
         Elf32_Addr file_end   = file_start + phdr->p_filesz;
 
         Elf32_Addr file_page_start = PAGE_START(file_start);
-        Elf32_Addr file_page_end   = PAGE_END(file_end);
 
         seg_addr = mmap((void*)seg_page_start,
                         file_end - file_page_start,
diff --git a/linker/linker_phdr.h b/linker/linker_phdr.h
index a759262..2d4d735 100644
--- a/linker/linker_phdr.h
+++ b/linker/linker_phdr.h
@@ -37,12 +37,6 @@
 
 #include "linker.h"
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-/* See linker_phdr.c for all usage documentation */
-
 int
 phdr_table_load(int                fd,
                 Elf32_Addr         phdr_offset,
@@ -107,8 +101,4 @@
                                Elf32_Addr**      dynamic,
                                size_t*           dynamic_count);
 
-#ifdef __cplusplus
-};
-#endif
-
 #endif /* LINKER_PHDR_H */
diff --git a/linker/rt.c b/linker/rt.cpp
similarity index 89%
rename from linker/rt.c
rename to linker/rt.cpp
index afbd651..710892a 100644
--- a/linker/rt.c
+++ b/linker/rt.cpp
@@ -28,9 +28,8 @@
 
 /*
  * This function is an empty stub where GDB locates a breakpoint to get notified
- * about linker activity.  It canʼt be inlined away, canʼt be hidden.
+ * about linker activity.  It canʼt be inlined away, can't be hidden.
  */
-void __attribute__((noinline)) __attribute__((visibility("default"))) rtld_db_dlactivity(void)
-{
+extern "C" void __attribute__((noinline)) __attribute__((visibility("default"))) rtld_db_dlactivity() {
 }