Methods to wrap getenv() and similar without leaks or race conditions in C

Question

The pointer returned by getenv should not be stored, as future calls to getenv could change it (or calls to setenv, etc). I am attempting to write a convenience wrapper around getenv which returns a default value if the environment variable is not found. I would prefer to not leak memory.

Options I've thought of:
Have the wrapper function copy the string getenv returns, either using malloc and strcpy or strdup (this is on a POSIX-compliant system). This works and allows error handling, but requires the caller to remember to free the pointer. That creates room for a memory leak.
Don't bother trying to cache the value, have each caller do that instead. This makes it easy to leave the race condition in. Use a global variable to store a copy of the string getenv returns. This would avoid the need for callers to free the memory, but would risk race conditions just like getenv alone unless I add some sort of locking/atomic updates.
Use a static variable in the function to cache the value. This is probably the best option, as it reuses the memory for subsequent calls, but can lead to race conditions.

I'm reasonably certain I'm missing something.

Answer 1

This is not true:

The pointer returned by getenv should not be stored, as future calls to getenv could change it

The following is:

(or calls to setenv, etc...

However, the conclusion here is just that you can't use setenv (or anything that modifies the environment) in a multithreaded process. Doing so also renders thread-unsafe any standard function which uses the environment.

So, go ahead using getenv and treat the strings its return values point to as immutable.