2

Sorry it might be a stupid question. I didn't link libaudit directly, but why its name shows in my binary?

Strings shows:

strings dataserver|grep libaudit
libaudit.so.0

readelf shows:

readelf -a dataserver|grep "Shared lib"
0x0000000000000001 (NEEDED)             Shared library: [libsapcrypto.so]
0x0000000000000001 (NEEDED)             Shared library: [libaio.so.1]
0x0000000000000001 (NEEDED)             Shared library: [libnsl.so.1]
0x0000000000000001 (NEEDED)             Shared library: [libdl.so.2]
0x0000000000000001 (NEEDED)             Shared library: [libpam.so.0]
0x0000000000000001 (NEEDED)             Shared library: [libpthread.so.0]
0x0000000000000001 (NEEDED)             Shared library: [librt.so.1]
0x0000000000000001 (NEEDED)             Shared library: [libstdc++.so.6]
0x0000000000000001 (NEEDED)             Shared library: [libm.so.6]
0x0000000000000001 (NEEDED)             Shared library: [libgcc_s.so.1]
0x0000000000000001 (NEEDED)             Shared library: [libc.so.6]
0x0000000000000001 (NEEDED)             Shared library: [libaudit.so.0]

What does it mean and is there anyway I can check why it is added into my binary?

Thanks

Update

Thanks. I'm reading the links below and adding some more findings. I find that libpam was linked and it requires libaudit.so.0

Check libpam.so.0

ldd /lib64/libpam.so.0
linux-vdso.so.1 =>  (0x00007ffff7fdf000)
libaudit.so.0 => /lib64/libaudit.so.0 (0x00007ffff7b80000)   <-- libaudit
libdl.so.2 => /lib64/libdl.so.2 (0x00007ffff797c000)
libc.so.6 => /lib64/libc.so.6 (0x00007ffff7616000)
/lib64/ld-linux-x86-64.so.2 (0x00007ffff7fe0000)

However, I have 2 binaries, both linked libpam.so. For binary1, it list libaudit.so.0 as NEEDED, but for binary2, it doesn't.

binary1 (with libpam but not depends on libaudit.so.0):

readelf -d binary1|grep "Shared lib"
0x0000000000000001 (NEEDED)             Shared library: [libsybcsi_core210.so]
0x0000000000000001 (NEEDED)             Shared library: [libsybcsi_profiler210.so]
0x0000000000000001 (NEEDED)             Shared library: [libsybcsi_propertiesconfig210.so]
0x0000000000000001 (NEEDED)             Shared library: [libsybcsi_openssl210.so]
0x0000000000000001 (NEEDED)             Shared library: [libaio.so.1]
0x0000000000000001 (NEEDED)             Shared library: [libnsl.so.1]
0x0000000000000001 (NEEDED)             Shared library: [libdl.so.2]
0x0000000000000001 (NEEDED)             Shared library: [libpam.so.0]       <--- libpam
0x0000000000000001 (NEEDED)             Shared library: [libpthread.so.0]
0x0000000000000001 (NEEDED)             Shared library: [librt.so.1]
0x0000000000000001 (NEEDED)             Shared library: [libstdc++.so.6]
0x0000000000000001 (NEEDED)             Shared library: [libm.so.6]
0x0000000000000001 (NEEDED)             Shared library: [libgcc_s.so.1]
0x0000000000000001 (NEEDED)             Shared library: [libc.so.6]

binary2 (with libpam but and depends on libaudit.so.0):

readelf -d binary2|grep "Shared lib"
0x0000000000000001 (NEEDED)             Shared library: [libsapcrypto.so]
0x0000000000000001 (NEEDED)             Shared library: [libaio.so.1]
0x0000000000000001 (NEEDED)             Shared library: [libnsl.so.1]
0x0000000000000001 (NEEDED)             Shared library: [libdl.so.2]
0x0000000000000001 (NEEDED)             Shared library: [libpam.so.0]       <--- libpam
0x0000000000000001 (NEEDED)             Shared library: [libpthread.so.0]
0x0000000000000001 (NEEDED)             Shared library: [librt.so.1]
0x0000000000000001 (NEEDED)             Shared library: [libstdc++.so.6]
0x0000000000000001 (NEEDED)             Shared library: [libm.so.6]
0x0000000000000001 (NEEDED)             Shared library: [libgcc_s.so.1]
0x0000000000000001 (NEEDED)             Shared library: [libc.so.6]
0x0000000000000001 (NEEDED)             Shared library: [libaudit.so.0] <--- libaudit

It confused me a lot about the key word "NEEDED", when will a lib is "NEEDED" if it is not directly used?

Zippon
  • 177
  • 7
  • 1
    Most likely one of those other shared objects needed it. Check out this Q&As: [Hierarchical ldd(1)](http://stackoverflow.com/questions/1488527/hierarchical-ldd1) – Phil Brubaker Apr 28 '17 at 03:15
  • Thank you I'm reading it... – Zippon Apr 28 '17 at 08:48
  • @Zippon Your update doesn't have enough info: are the two binaries linked with the same linker? Same link flags? – Employed Russian Apr 28 '17 at 13:45
  • @EmployedRussian yes they're linked with same linker and flags. But as they're in different branches, there're some libs are different. Anyway, I checked the diffed libs, they have no reference to libaudit.so.... I'm wondering when will a shared lib marked as "NEEDED". As I can see the "libpam" need "libaudit", but why "libaudit" only needed by binary2? – Zippon May 03 '17 at 09:14

2 Answers2

1

What does it mean

It means your binary depends on it.

and is there anyway I can check why it is added into my binary?

Most likely the linker you used found that some other library on the link line depends on libaudit, and automagically added it in.

GNU-ld does this, and Gold doesn't (producing a steady stream of programs that have incorrect Makefiles and fail to link with Gold).

If you link with -v flag, you should see the actual link command, although it may be hidden by collect2 or some such wrapper.

Running the link under strace -fvs 1024 -e execve will show the actual link command for sure.

Employed Russian
  • 199,314
  • 34
  • 295
  • 362
0

All right, I find the cause.

It's due to some reference of "_edata" and "_end" in my code. In libpam.so, it is not found but libaudit.so which is needed for libpam.so, it was found and linker resolved it, then add libaudit as "NEEDED".

And _end is exposed as follows from linker scripts –

_end = .; PROVIDE (end = .);

This means, we should be using “end” and not “_end” unless we PROVIDE “_end” with our own linker scripts. So, the fix is to change _end (and all such related symbols like _etext and _edata) to end (and etext, edata) so that they will be resolved correctly from standard libc, avoiding any dependency on other shared objects like libaudit.so.

Zippon
  • 177
  • 7