coreutils: Protect against env -a for security (#10773)

This prevents an attacker from spoofing argv[0] to bypass apparmor restrictions.

- `env -a false ls` now correctly runs `ls` instead of dispatching as `false`
- Also works under masked `/proc` (does not rely on /proc/self/exe).

Closes #10135

tests/test_util_name.rs

@@ -26,6 +26,20 @@ fn init() {
     eprintln!("Setting UUTESTS_BINARY_PATH={TESTS_BINARY}");
 }
 
+#[test]
+#[cfg(all(feature = "env", any(target_os = "linux", target_os = "android")))]
+fn binary_name_protection() {
+    let ts = TestScenario::new("env");
+    let bin = ts.bin_path.clone();
+    ts.ucmd()
+        .arg("-a")
+        .arg("hijacked")
+        .arg(&bin)
+        .arg("--version")
+        .succeeds()
+        .stdout_contains("coreutils");
+}
+
 #[test]
 #[cfg(feature = "ls")]
 fn execution_phrase_double() {