libc

Now granted, you'd need to interact with external libraries (including libc/libc++) that'll want to use size_t etc.

Source-distributed software does not have to care usually, but for binary-only distribution, statically compiling the libc is the easiest bet.

The former is similar, but also uses a non-GNU userland in Busybox and musl libc, which should lower the TCB attack surface.

Statically compiling the libc is common with proprietary Linux software, if I remember correctly.

Indeed there are many different libc's used in different linux applications - glibc on many desktop distros, bionic libc on android, uclibc, musl and others on various embedded/specialized setups.

Is there are library of constant time functions for security sensitive applications to replace the standard ones in libc?

Go works around this by explicitly not calling into libc et al -- all system calls are issued directly.

So you can legally dynamically link to OS X's libc or Windows' win32 as needed to run a normal process.

Yes, Android 5.0 or later is required due to the libc changes made in lollipop.

Linux doesn't have any single fixed libc, the system call interface is the public API.

For the uninitiated, these are libc libraries for embedded systems (alternatives to glibc).

Android doesn't change this, although it ships a different, more minimal libc.

The "stdlib doesn't report failure on allocation" stuff isn't really relevant; it's not like people use libc malloc in the Linux kernel.

I see OpenSSL and libc as being effectively the "system version" as you would know it in Mac OS or Windows.