diff --git a/libc/include/string.h b/libc/include/string.h
index 6643d28..70e0042 100644
--- a/libc/include/string.h
+++ b/libc/include/string.h
@@ -201,8 +201,6 @@
     return __strlcat_chk(dest, src, size, bos);
 }
 
-__purefunc extern size_t __strlen_real(const char *)
-    __asm__(__USER_LABEL_PREFIX__ "strlen");
 extern size_t __strlen_chk(const char *, size_t);
 
 __BIONIC_FORTIFY_INLINE
@@ -211,14 +209,17 @@
 
     // Compiler doesn't know destination size. Don't call __strlen_chk
     if (bos == __BIONIC_FORTIFY_UNKNOWN_SIZE) {
-        return __strlen_real(s);
+        return __builtin_strlen(s);
+    }
+
+    size_t slen = __builtin_strlen(s);
+    if (__builtin_constant_p(slen)) {
+        return slen;
     }
 
     return __strlen_chk(s, bos);
 }
 
-__purefunc extern char* __strchr_real(const char *, int)
-    __asm__(__USER_LABEL_PREFIX__ "strchr");
 extern char* __strchr_chk(const char *, int, size_t);
 
 __BIONIC_FORTIFY_INLINE
@@ -227,14 +228,17 @@
 
     // Compiler doesn't know destination size. Don't call __strchr_chk
     if (bos == __BIONIC_FORTIFY_UNKNOWN_SIZE) {
-        return __strchr_real(s, c);
+        return __builtin_strchr(s, c);
+    }
+
+    size_t slen = __builtin_strlen(s);
+    if (__builtin_constant_p(slen) && (slen < bos)) {
+        return __builtin_strchr(s, c);
     }
 
     return __strchr_chk(s, c, bos);
 }
 
-__purefunc extern char* __strrchr_real(const char *, int)
-    __asm__(__USER_LABEL_PREFIX__ "strrchr");
 extern char* __strrchr_chk(const char *, int, size_t);
 
 __BIONIC_FORTIFY_INLINE
@@ -243,7 +247,12 @@
 
     // Compiler doesn't know destination size. Don't call __strrchr_chk
     if (bos == __BIONIC_FORTIFY_UNKNOWN_SIZE) {
-        return __strrchr_real(s, c);
+        return __builtin_strrchr(s, c);
+    }
+
+    size_t slen = __builtin_strlen(s);
+    if (__builtin_constant_p(slen) && (slen < bos)) {
+        return __builtin_strrchr(s, c);
     }
 
     return __strrchr_chk(s, c, bos);
diff --git a/linker/linker_environ.cpp b/linker/linker_environ.cpp
index 16f017e..8ae5a9d 100644
--- a/linker/linker_environ.cpp
+++ b/linker/linker_environ.cpp
@@ -112,7 +112,6 @@
 static bool __is_unsafe_environment_variable(const char* name) {
   // None of these should be allowed in setuid programs.
   static const char* const UNSAFE_VARIABLE_NAMES[] = {
-      "ANDROID_PROPERTY_WORKSPACE",
       "GCONV_PATH",
       "GETCONF_DIR",
       "HOSTALIASES",
diff --git a/tests/string_test.cpp b/tests/string_test.cpp
index 08c73a1..1720058 100644
--- a/tests/string_test.cpp
+++ b/tests/string_test.cpp
@@ -316,6 +316,27 @@
   ASSERT_EXIT(strcpy(buf, orig), testing::KilledBySignal(SIGSEGV), "");
   free(orig);
 }
+
+TEST(string_DeathTest, strlen_fortified) {
+  ::testing::FLAGS_gtest_death_test_style = "threadsafe";
+  char buf[10];
+  memcpy(buf, "0123456789", sizeof(buf));
+  ASSERT_EXIT(printf("%d", strlen(buf)), testing::KilledBySignal(SIGSEGV), "");
+}
+
+TEST(string_DeathTest, strchr_fortified) {
+  ::testing::FLAGS_gtest_death_test_style = "threadsafe";
+  char buf[10];
+  memcpy(buf, "0123456789", sizeof(buf));
+  ASSERT_EXIT(printf("%s", strchr(buf, 'a')), testing::KilledBySignal(SIGSEGV), "");
+}
+
+TEST(string_DeathTest, strrchr_fortified) {
+  ::testing::FLAGS_gtest_death_test_style = "threadsafe";
+  char buf[10];
+  memcpy(buf, "0123456789", sizeof(buf));
+  ASSERT_EXIT(printf("%s", strrchr(buf, 'a')), testing::KilledBySignal(SIGSEGV), "");
+}
 #endif
 
 #if __BIONIC__