Which libraries appear in /proc/$PID/pmaps?

Question

On Linux you can inspect /proc/$PID/pmaps to see the libraries loaded by a particular program, and a program can open /proc/self/pmaps to examine the libraries it itself has loaded.

I know pmaps will only contain dynamic libraries, and obviously the kernel can't predict which libraries we might dlopen at a later point, so I expect those aren't included in /proc/self/maps. But I'm unsure of a few other other scenarios:

1. Are libraries that have been linked at build time but we haven't called any function in yet included? My understanding is the Linux delays linking symbols until the first time they are used, so I'm not sure if they'll show up.

2. Does pmaps contain all the libraries used recursively? E.g. if I look at each library in pmaps and run ldd on it, and then run ldd on those, ad nauseum, I shouldn't find any new libraries that weren't in the original pmaps? I tried this on a couple binaries and it appears to be so but maybe I'm getting lucky.

Answer 1

/proc/$pid/maps is not only going to list libraries that are loaded, but also ALL other mapped memory segments.

Read this thread and the article in there:

Understanding Linux /proc/id/maps

Answer 2

Are libraries that have been linked at build time but we haven't called any function in yet included?

Yes: the runtime loader will mmap every library that your executable directly depends on, before your program starts running.

You can find the list of such libraries by running

readelf -d a.out | grep NEEDED

Does pmaps contain all the libraries used recursively?

Yes: if a library that you directly depend on itself depends on some other library, the runtime loader will mmap the recursive dependencies as well.

My understanding is the Linux delays linking symbols until the first time they are used

That is mosty correct for function symbols, but false for data symbols, which can't be resolved lazily.

Also, whether the symbols are resolved lazily or not depends on LD_BIND_NOW environment variable, and on an equivalent setting in the executable dynamic section, controlled by -znow linker flag.

None of that changes the mmap pciture though; if you have a DT_NEEDED entry for foo.so in your dynamic section, then foo.so will be mmaped (and will show in /proc/self/*map*) independent of lazy or non-lazy resolution.