rpath for shared libraries

[Andrew Suffield]

On Tue, Jan 12, 2010 at 08:22:48AM +0000, Duncan Coutts wrote:
> man ld.so says:
> 
> The shared libraries needed by the program are searched for in the
> following order:
> 
>       * (ELF only) Using the directories specified in the  DT_RPATH
>         dynamic section  attribute of the binary if present and
>         DT_RUNPATH attribute does not exist.  Use of DT_RPATH is
>         deprecated.
>       * Using the environment variable LD_LIBRARY_PATH.  Except if the
>         executable is a set-user-ID/set-group-ID binary, in which case
>         it is ignored.
>       * (ELF only) Using the directories specified in the DT_RUNPATH
>         dynamic section attribute of the binary if present.

glibc says (it's sufficient to read the comments):

------------------------------------------------------------------------

      /* Search for NAME in several places.  */

      size_t namelen = strlen (name) + 1;

      if (__builtin_expect (GLRO(dl_debug_mask) & DL_DEBUG_LIBS, 0))
	_dl_debug_printf ("find library=%s [%lu]; searching\n", name, nsid);

      fd = -1;

      /* When the object has the RUNPATH information we don't use any
         RPATHs.  */
      if (loader == NULL || loader->l_info[DT_RUNPATH] == NULL)
	{
	  /* This is the executable's map (if there is one).  Make sure that
	     we do not look at it twice.  */
	  struct link_map *main_map = GL(dl_ns)[LM_ID_BASE]._ns_loaded;
	  bool did_main_map = false;

	  /* First try the DT_RPATH of the dependent object that caused NAME
	     to be loaded.  Then that object's dependent, and on up.  */
	  for (l = loader; l; l = l->l_loader)
	    if (cache_rpath (l, &l->l_rpath_dirs, DT_RPATH, "RPATH"))
	      {
		fd = open_path (name, namelen, preloaded, &l->l_rpath_dirs,
				&realname, &fb, loader, LA_SER_RUNPATH,
				&found_other_class);
		if (fd != -1)
		  break;

		did_main_map |= l == main_map;
	      }

	  /* If dynamically linked, try the DT_RPATH of the executable
             itself.  NB: we do this for lookups in any namespace.  */
	  if (fd == -1 && !did_main_map
	      && main_map != NULL && main_map->l_type != lt_loaded
	      && cache_rpath (main_map, &main_map->l_rpath_dirs, DT_RPATH,
			      "RPATH"))
	    fd = open_path (name, namelen, preloaded, &main_map->l_rpath_dirs,
			    &realname, &fb, loader ?: main_map, LA_SER_RUNPATH,
			    &found_other_class);
	}

      /* Try the LD_LIBRARY_PATH environment variable.  */
      if (fd == -1 && env_path_list.dirs != (void *) -1)
	fd = open_path (name, namelen, preloaded, &env_path_list,
			&realname, &fb,
			loader ?: GL(dl_ns)[LM_ID_BASE]._ns_loaded,
			LA_SER_LIBPATH, &found_other_class);

      /* Look at the RUNPATH information for this binary.  */
      if (fd == -1 && loader != NULL
	  && cache_rpath (loader, &loader->l_runpath_dirs,
			  DT_RUNPATH, "RUNPATH"))
	fd = open_path (name, namelen, preloaded,
			&loader->l_runpath_dirs, &realname, &fb, loader,
			LA_SER_RUNPATH, &found_other_class);

      if (fd == -1
	  && (__builtin_expect (! preloaded, 1)
	      || ! INTUSE(__libc_enable_secure)))
	{
	  /* Check the list of libraries in the file /etc/ld.so.cache,
	     for compatibility with Linux's ldconfig program.  */
	  const char *cached = _dl_load_cache_lookup (name);

<snip>
	}

      /* Finally, try the default path.  */
      if (fd == -1
	  && ((l = loader ?: GL(dl_ns)[nsid]._ns_loaded) == NULL
	      || __builtin_expect (!(l->l_flags_1 & DF_1_NODEFLIB), 1))
	  && rtld_search_dirs.dirs != (void *) -1)
	fd = open_path (name, namelen, preloaded, &rtld_search_dirs,
			&realname, &fb, l, LA_SER_DEFAULT, &found_other_class);

------------------------------------------------------------------------

> Indeed you can test this and find that this is exactly how it behaves.
> 
> $ ./main 
> 42
> 
> $ LD_LIBRARY_PATH=bar ./main 
> 43
> 
> This is a main linking to libfoo.so via rpath but overridden to link to
> a separate ./bar/libfoo.so that exports a different implementation of
> extern int foo();

asuffield at cyclone:~/tmp$ echo 'int foo = 42;' > foo42.c
asuffield at cyclone:~/tmp$ echo 'int foo = 43;' > foo43.c
asuffield at cyclone:~/tmp$ gcc -shared -o libfoo.so foo42.c
asuffield at cyclone:~/tmp$ gcc -shared -o bar/libfoo.so foo43.c
asuffield at cyclone:~/tmp$ printf '#include <stdio.h>\nextern int foo; int main(void){printf("%%d\\n",foo);}\n' > main.c
asuffield at cyclone:~/tmp$ gcc -o main main.c libfoo.so -Wl,-rpath .
asuffield at cyclone:~/tmp$ ./main
42
asuffield at cyclone:~/tmp$ LD_LIBRARY_PATH=bar ./main
42
asuffield at cyclone:~/tmp$ LD_DEBUG=libs LD_LIBRARY_PATH=bar ./main
     20013:	find library=libfoo.so [0]; searching
     20013:	 search path=./tls/x86_64:./tls:./x86_64:.		(RPATH from file ./main)
     20013:	  trying file=./tls/x86_64/libfoo.so
     20013:	  trying file=./tls/libfoo.so
     20013:	  trying file=./x86_64/libfoo.so
     20013:	  trying file=./libfoo.so
     20013:	
<snip>

Are you perhaps not on a glibc system? The manpage you quoted is not
the one normally found there (which also happens to be wrong, sigh). I
did say that this behaviour is totally non-portable. glibc follows the
ELF specification and, approximately, Solaris, but most other things
do not.

> > It overrides everything, which is why it's so bad. The only thing you
> > can do is use --inhibit-rpath, but that requires you to maintain a
> > full list of the broken objects that have rpath entries, and use a
> > wrapper script to start every binary - in which case you might as well
> > just forget the whole thing and use LD_PRELOAD.
> 
> Is your concern about old .so libs that have an DT_RPATH but no
> DT_RUNPATH entry and thus invoke the old behaviour?

ghc uses DT_RPATH with no DT_RUNPATH, because it relies on dlopen()
for addDLL() to work [see previous mail re: DT_RUNPATH does not work
with dlopen(), by design]

I am not sure why you think there are any 'new' libraries that use
DT_RUNPATH. It's a little-known and rarely-used feature; the effort to
replace DT_RPATH is widely regarded to have been a failure.