I am trying to dump the full paths of the shared libraries that are imported by an ELF file (/usr/bin/ls
)
Using readelf --dyn-syms /usr/bin/ls
I get the name of the libraries, but not where they are located on the filesystem:
101: 0000000000000000 0 FUNC GLOBAL DEFAULT UND [...]@LIBSELINUX_1.0 (4)
Using objdump -T /usr/bin/ls
I get even more information (including function names):
0000000000000000 DF *UND* 0000000000000000 (LIBSELINUX_1.0) getfilecon
This is useful information, but how can I extract the location of the library on disk?
I could run the file and see what it opens via lsof
, but is there any way to do this without running the file?
man ldd ld.so
.ldd /usr/bin/ls
.ld.so
loads and interprets the ELF file, mapping the shared libraries, reading the code into memory, allocating writable data, and starting your program.ldd /usr/bin/ls
give you the information you need?LD_LIBRARY_PATH
and/etc/ld.so.conf
will change what libraries are loaded.