Can I just emit the warning for clang if
--sysroot is set and /usr/include /usr/local/include are in the include file search path?

if you look at the gcc source, we reject more paths than that:
         for (p = heads[chain]; p; p = p->next)
           if (!strncmp (p->name, "/usr/include", 12)
               || !strncmp (p->name, "/usr/local/include", 18)
               || !strncmp (p->name, "/usr/X11R6/include", 18)
               || !strncmp (p->name, "/lib", 4)
               || !strncmp (p->name, "/usr/local/lib", 14))  
             warning (OPT_Wpoison_system_directories,
                      "include location \"%s\" is unsafe for "
                      "cross-compilation", p->name);
note that those are strncmp's, not strcmp's.

i don't have an opinion about making it always fire if --sysroot is active (with a path other than /).

can we prioritize this? we're starting to see bad flags filter back in to builds because clang isn't rejecting then like gcc did. this is a regression in reliability.

This bug has an owner, thus, it's been triaged. Changing status to "assigned".

ping ... we're still seeing this happen with packages in the tree and people end up mistriaging them (if they fail at all).  can we please get something going here ?

ok, let me try to find someone to work on this. We are down 2 people at the moment. 

Yunlian had a patch at some point: 

https://chromium-review.googlesource.com/c/chromiumos/overlays/chromiumos-overlay/+/492089

what happened to this?