I am trying to dump the full paths of the shared libraries that are imported by an ELF file (/usr/bin/ls)

Using readelf --dyn-syms /usr/bin/ls I get the name of the libraries, but not where they are located on the filesystem:

101: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND [...]@LIBSELINUX_1.0 (4)

Using objdump -T /usr/bin/ls I get even more information (including function names):

0000000000000000      DF *UND*  0000000000000000 (LIBSELINUX_1.0) getfilecon

This is useful information, but how can I extract the location of the library on disk? I could run the file and see what it opens via lsof, but is there any way to do this without running the file?


1 Answer 1


This is what ldd is for:

$ ldd /bin/ls
    linux-vdso.so.1 (0x00007ffd67705000)
    libselinux.so.1 => /lib/x86_64-linux-gnu/libselinux.so.1 (0x00007f25aaab6000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f25aa8f1000)
    libpcre2-8.so.0 => /usr/lib/x86_64-linux-gnu/libpcre2-8.so.0 (0x00007f25aa859000)
    libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f25aa853000)
    /lib64/ld-linux-x86-64.so.2 (0x00007f25aab52000)
    libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f25aa831000)

This is liable to include more than the libraries shown by readelf, since it will process transitive dependencies as well.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .