1

I am trying to dump the full paths of the shared libraries that are imported by an ELF file (/usr/bin/ls)

Using readelf --dyn-syms /usr/bin/ls I get the name of the libraries, but not where they are located on the filesystem:

101: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND [...]@LIBSELINUX_1.0 (4)

Using objdump -T /usr/bin/ls I get even more information (including function names):

0000000000000000      DF *UND*  0000000000000000 (LIBSELINUX_1.0) getfilecon

This is useful information, but how can I extract the location of the library on disk? I could run the file and see what it opens via lsof, but is there any way to do this without running the file?

Improve this question
3
  • Read man ldd ld.so. ldd /usr/bin/ls. ld.so loads and interprets the ELF file, mapping the shared libraries, reading the code into memory, allocating writable data, and starting your program.
    – waltinator
    Feb 28, 2022 at 20:19
  • 1
    Does ldd /usr/bin/ls give you the information you need? LD_LIBRARY_PATH and /etc/ld.so.conf will change what libraries are loaded.
    – doneal24
    Feb 28, 2022 at 20:19
  • Yes someone post in an answer if you want, thank you
    – dcom-launch
    Feb 28, 2022 at 20:39

1 Answer 1

Reset to default
3

This is what ldd is for:

$ ldd /bin/ls
    linux-vdso.so.1 (0x00007ffd67705000)
    libselinux.so.1 => /lib/x86_64-linux-gnu/libselinux.so.1 (0x00007f25aaab6000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f25aa8f1000)
    libpcre2-8.so.0 => /usr/lib/x86_64-linux-gnu/libpcre2-8.so.0 (0x00007f25aa859000)
    libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f25aa853000)
    /lib64/ld-linux-x86-64.so.2 (0x00007f25aab52000)
    libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f25aa831000)

This is liable to include more than the libraries shown by readelf, since it will process transitive dependencies as well.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .