1LD.SO(8) Linux Programmer's Manual LD.SO(8)
2
6 ld.so, ld-linux.so - dynamic linker/loader
7
9 The dynamic linker can be run either indirectly by running some dynami‐
10 cally linked program or shared object (in which case no command-line
11 options to the dynamic linker can be passed and, in the ELF case, the
12 dynamic linker which is stored in the .interp section of the program is
13 executed) or directly by running:
14 /lib/ld-linux.so.* [OPTIONS] [PROGRAM [ARGUMENTS]]
16
18 The programs ld.so and ld-linux.so* find and load the shared objects
19 (shared libraries) needed by a program, prepare the program to run, and
20 then run it.
21 Linux binaries require dynamic linking (linking at run time) unless the
23 -static option was given to ld(1) during compilation.
24 The program ld.so handles a.out binaries, a binary format used long
26 ago. The program ld-linux.so* (/lib/ld-linux.so.1 for libc5,
27 /lib/ld-linux.so.2 for glibc2) handles binaries that are in the more
28 modern ELF format. Both programs have the same behavior, and use the
29 same support files and programs (ldd(1), ldconfig(8), and
30 /etc/ld.so.conf).
31 When resolving shared object dependencies, the dynamic linker first
33 inspects each dependency string to see if it contains a slash (this can
34 occur if a shared object pathname containing slashes was specified at
35 link time). If a slash is found, then the dependency string is inter‐
36 preted as a (relative or absolute) pathname, and the shared object is
37 loaded using that pathname.
38 If a shared object dependency does not contain a slash, then it is
40 searched for in the following order:
41 o Using the directories specified in the DT_RPATH dynamic section
43 attribute of the binary if present and DT_RUNPATH attribute does not
44 exist. Use of DT_RPATH is deprecated.
45 o Using the environment variable LD_LIBRARY_PATH, unless the exe‐
47 cutable is being run in secure-execution mode (see below), in which
48 case this variable is ignored.
49 o Using the directories specified in the DT_RUNPATH dynamic section
51 attribute of the binary if present. Such directories are searched
52 only to find those objects required by DT_NEEDED (direct dependen‐
53 cies) entries and do not apply to those objects' children, which
54 must themselves have their own DT_RUNPATH entries. This is unlike
55 DT_RPATH, which is applied to searches for all children in the
56 dependency tree.
57 o From the cache file /etc/ld.so.cache, which contains a compiled list
59 of candidate shared objects previously found in the augmented
60 library path. If, however, the binary was linked with the -z node‐
61 flib linker option, shared objects in the default paths are skipped.
62 Shared objects installed in hardware capability directories (see
63 below) are preferred to other shared objects.
64 o In the default path /lib, and then /usr/lib. (On some 64-bit archi‐
66 tectures, the default paths for 64-bit shared objects are /lib64,
67 and then /usr/lib64.) If the binary was linked with the -z nodeflib
68 linker option, this step is skipped.
69 Rpath token expansion
71 The dynamic linker understands certain token strings in an rpath speci‐
72 fication (DT_RPATH or DT_RUNPATH). Those strings are substituted as
73 follows:
74 $ORIGIN (or equivalently ${ORIGIN})
76 This expands to the directory containing the program or shared
77 object. Thus, an application located in somedir/app could be
78 compiled with
79 gcc -Wl,-rpath,'$ORIGIN/../lib'
81 so that it finds an associated shared object in somedir/lib no
83 matter where somedir is located in the directory hierarchy.
84 This facilitates the creation of "turn-key" applications that do
85 not need to be installed into special directories, but can
86 instead be unpacked into any directory and still find their own
87 shared objects.
88 $LIB (or equivalently ${LIB})
90 This expands to lib or lib64 depending on the architecture
91 (e.g., on x86-64, it expands to lib64 and on x86-32, it expands
92 to lib).
93 $PLATFORM (or equivalently ${PLATFORM})
95 This expands to a string corresponding to the processor type of
96 the host system (e.g., "x86_64"). On some architectures, the
97 Linux kernel doesn't provide a platform string to the dynamic
98 linker. The value of this string is taken from the AT_PLATFORM
99 value in the auxiliary vector (see getauxval(3)).
100
102 --audit list
103 Use objects named in list as auditors. The objects in list are
104 delimited by colons.
105 --inhibit-cache
107 Do not use /etc/ld.so.cache.
108 --library-path path
110 Use path instead of LD_LIBRARY_PATH environment variable setting
111 (see below). The names ORIGIN, LIB, and PLATFORM are inter‐
112 preted as for the LD_LIBRARY_PATH environment variable.
113 --inhibit-rpath list
115 Ignore RPATH and RUNPATH information in object names in list.
116 This option is ignored when running in secure-execution mode
117 (see below). The objects in list are delimited by colons or
118 spaces.
119 --list List all dependencies and how they are resolved.
121 --preload list (since glibc 2.30)
123 Preload the objects specified in list. The objects in list are
124 delimited by colons or spaces. The objects are preloaded as
125 explained in the description of the LD_PRELOAD environment vari‐
126 able below.
127 By contrast with LD_PRELOAD, the --preload option provides a way
129 to perform preloading for a single executable without affecting
130 preloading performed in any child process that executes a new
131 program.
132 --verify
134 Verify that program is dynamically linked and this dynamic
135 linker can handle it.
136
138 Various environment variables influence the operation of the dynamic
139 linker.
140 Secure-execution mode
142 For security reasons, if the dynamic linker determines that a binary
143 should be run in secure-execution mode, the effects of some environment
144 variables are voided or modified, and furthermore those environment
145 variables are stripped from the environment, so that the program does
146 not even see the definitions. Some of these environment variables
147 affect the operation of the dynamic linker itself, and are described
148 below. Other environment variables treated in this way include:
149 GCONV_PATH, GETCONF_DIR, HOSTALIASES, LOCALDOMAIN, LOCPATH, MAL‐
150 LOC_TRACE, NIS_PATH, NLSPATH, RESOLV_HOST_CONF, RES_OPTIONS, TMPDIR,
151 and TZDIR.
152 A binary is executed in secure-execution mode if the AT_SECURE entry in
154 the auxiliary vector (see getauxval(3)) has a nonzero value. This
155 entry may have a nonzero value for various reasons, including:
156 * The process's real and effective user IDs differ, or the real and
158 effective group IDs differ. This typically occurs as a result of
159 executing a set-user-ID or set-group-ID program.
160 * A process with a non-root user ID executed a binary that conferred
162 capabilities to the process.
163 * A nonzero value may have been set by a Linux Security Module.
165 Environment variables
167 Among the more important environment variables are the following:
168 LD_ASSUME_KERNEL (since glibc 2.2.3)
170 Each shared object can inform the dynamic linker of the minimum
171 kernel ABI version that it requires. (This requirement is
172 encoded in an ELF note section that is viewable via readelf -n
173 as a section labeled NT_GNU_ABI_TAG.) At run time, the dynamic
174 linker determines the ABI version of the running kernel and will
175 reject loading shared objects that specify minimum ABI versions
176 that exceed that ABI version.
177 LD_ASSUME_KERNEL can be used to cause the dynamic linker to
179 assume that it is running on a system with a different kernel
180 ABI version. For example, the following command line causes the
181 dynamic linker to assume it is running on Linux 2.2.5 when load‐
182 ing the shared objects required by myprog:
183 $ LD_ASSUME_KERNEL=2.2.5 ./myprog
185 On systems that provide multiple versions of a shared object (in
187 different directories in the search path) that have different
188 minimum kernel ABI version requirements, LD_ASSUME_KERNEL can be
189 used to select the version of the object that is used (dependent
190 on the directory search order).
191 Historically, the most common use of the LD_ASSUME_KERNEL fea‐
193 ture was to manually select the older LinuxThreads POSIX threads
194 implementation on systems that provided both LinuxThreads and
195 NPTL (which latter was typically the default on such systems);
196 see pthreads(7).
197 LD_BIND_NOW (since glibc 2.1.1)
199 If set to a nonempty string, causes the dynamic linker to
200 resolve all symbols at program startup instead of deferring
201 function call resolution to the point when they are first refer‐
202 enced. This is useful when using a debugger.
203 LD_LIBRARY_PATH
205 A list of directories in which to search for ELF libraries at
206 execution time. The items in the list are separated by either
207 colons or semicolons, and there is no support for escaping
208 either separator.
209 This variable is ignored in secure-execution mode.
211 Within the pathnames specified in LD_LIBRARY_PATH, the dynamic
213 linker expands the tokens $ORIGIN, $LIB, and $PLATFORM (or the
214 versions using curly braces around the names) as described above
215 in Rpath token expansion. Thus, for example, the following
216 would cause a library to be searched for in either the lib or
217 lib64 subdirectory below the directory containing the program to
218 be executed:
219 $ LD_LIBRARY_PATH='$ORIGIN/$LIB' prog
221 (Note the use of single quotes, which prevent expansion of $ORI‐
223 GIN and $LIB as shell variables!)
224 LD_PRELOAD
226 A list of additional, user-specified, ELF shared objects to be
227 loaded before all others. This feature can be used to selec‐
228 tively override functions in other shared objects.
229 The items of the list can be separated by spaces or colons, and
231 there is no support for escaping either separator. The objects
232 are searched for using the rules given under DESCRIPTION.
233 Objects are searched for and added to the link map in the left-
234 to-right order specified in the list.
235 In secure-execution mode, preload pathnames containing slashes
237 are ignored. Furthermore, shared objects are preloaded only
238 from the standard search directories and only if they have set-
239 user-ID mode bit enabled (which is not typical).
240 Within the names specified in the LD_PRELOAD list, the dynamic
242 linker understands the tokens $ORIGIN, $LIB, and $PLATFORM (or
243 the versions using curly braces around the names) as described
244 above in Rpath token expansion. (See also the discussion of
245 quoting under the description of LD_LIBRARY_PATH.)
246 There are various methods of specifying libraries to be pre‐
248 loaded, and these are handled in the following order:
249 (1) The LD_PRELOAD environment variable.
251 (2) The --preload command-line option when invoking the dynamic
253 linker directly.
254 (3) The /etc/ld.so.preload file (described below).
256 LD_TRACE_LOADED_OBJECTS
258 If set (to any value), causes the program to list its dynamic
259 dependencies, as if run by ldd(1), instead of running normally.
260 Then there are lots of more or less obscure variables, many obsolete or
262 only for internal use.
263 LD_AUDIT (since glibc 2.4)
265 A list of user-specified, ELF shared objects to be loaded before
266 all others in a separate linker namespace (i.e., one that does
267 not intrude upon the normal symbol bindings that would occur in
268 the process) These objects can be used to audit the operation of
269 the dynamic linker. The items in the list are colon-separated,
270 and there is no support for escaping the separator.
271 LD_AUDIT is ignored in secure-execution mode.
273 The dynamic linker will notify the audit shared objects at so-
275 called auditing checkpoints—for example, loading a new shared
276 object, resolving a symbol, or calling a symbol from another
277 shared object—by calling an appropriate function within the
278 audit shared object. For details, see rtld-audit(7). The
279 auditing interface is largely compatible with that provided on
280 Solaris, as described in its Linker and Libraries Guide, in the
281 chapter Runtime Linker Auditing Interface.
282 Within the names specified in the LD_AUDIT list, the dynamic
284 linker understands the tokens $ORIGIN, $LIB, and $PLATFORM (or
285 the versions using curly braces around the names) as described
286 above in Rpath token expansion. (See also the discussion of
287 quoting under the description of LD_LIBRARY_PATH.)
288 Since glibc 2.13, in secure-execution mode, names in the audit
290 list that contain slashes are ignored, and only shared objects
291 in the standard search directories that have the set-user-ID
292 mode bit enabled are loaded.
293 LD_BIND_NOT (since glibc 2.1.95)
295 If this environment variable is set to a nonempty string, do not
296 update the GOT (global offset table) and PLT (procedure linkage
297 table) after resolving a function symbol. By combining the use
298 of this variable with LD_DEBUG (with the categories bindings and
299 symbols), one can observe all run-time function bindings.
300 LD_DEBUG (since glibc 2.1)
302 Output verbose debugging information about operation of the
303 dynamic linker. The content of this variable is one of more of
304 the following categories, separated by colons, commas, or (if
305 the value is quoted) spaces:
306 help Specifying help in the value of this variable does
308 not run the specified program, and displays a help
309 message about which categories can be specified in
310 this environment variable.
311 all Print all debugging information (except statistics
313 and unused; see below).
314 bindings Display information about which definition each sym‐
316 bol is bound to.
317 files Display progress for input file.
319 libs Display library search paths.
321 reloc Display relocation processing.
323 scopes Display scope information.
325 statistics Display relocation statistics.
327 symbols Display search paths for each symbol look-up.
329 unused Determine unused DSOs.
331 versions Display version dependencies.
333 Since glibc 2.3.4, LD_DEBUG is ignored in secure-execution mode,
335 unless the file /etc/suid-debug exists (the content of the file
336 is irrelevant).
337 LD_DEBUG_OUTPUT (since glibc 2.1)
339 By default, LD_DEBUG output is written to standard error. If
340 LD_DEBUG_OUTPUT is defined, then output is written to the path‐
341 name specified by its value, with the suffix "." (dot) followed
342 by the process ID appended to the pathname.
343 LD_DEBUG_OUTPUT is ignored in secure-execution mode.
345 LD_DYNAMIC_WEAK (since glibc 2.1.91)
347 By default, when searching shared libraries to resolve a symbol
348 reference, the dynamic linker will resolve to the first defini‐
349 tion it finds.
350 Old glibc versions (before 2.2), provided a different behavior:
352 if the linker found a symbol that was weak, it would remember
353 that symbol and keep searching in the remaining shared
354 libraries. If it subsequently found a strong definition of the
355 same symbol, then it would instead use that definition. (If no
356 further symbol was found, then the dynamic linker would use the
357 weak symbol that it initially found.)
358 The old glibc behavior was nonstandard. (Standard practice is
360 that the distinction between weak and strong symbols should have
361 effect only at static link time.) In glibc 2.2, the dynamic
362 linker was modified to provide the current behavior (which was
363 the behavior that was provided by most other implementations at
364 that time).
365 Defining the LD_DYNAMIC_WEAK environment variable (with any
367 value) provides the old (nonstandard) glibc behavior, whereby a
368 weak symbol in one shared library may be overridden by a strong
369 symbol subsequently discovered in another shared library. (Note
370 that even when this variable is set, a strong symbol in a shared
371 library will not override a weak definition of the same symbol
372 in the main program.)
373 Since glibc 2.3.4, LD_DYNAMIC_WEAK is ignored in secure-execu‐
375 tion mode.
376 LD_HWCAP_MASK (since glibc 2.1)
378 Mask for hardware capabilities.
379 LD_ORIGIN_PATH (since glibc 2.1)
381 Path where the binary is found.
382 Since glibc 2.4, LD_ORIGIN_PATH is ignored in secure-execution
384 mode.
385 LD_POINTER_GUARD (glibc from 2.4 to 2.22)
387 Set to 0 to disable pointer guarding. Any other value enables
388 pointer guarding, which is also the default. Pointer guarding
389 is a security mechanism whereby some pointers to code stored in
390 writable program memory (return addresses saved by setjmp(3) or
391 function pointers used by various glibc internals) are mangled
392 semi-randomly to make it more difficult for an attacker to
393 hijack the pointers for use in the event of a buffer overrun or
394 stack-smashing attack. Since glibc 2.23, LD_POINTER_GUARD can
395 no longer be used to disable pointer guarding, which is now
396 always enabled.
397 LD_PROFILE (since glibc 2.1)
399 The name of a (single) shared object to be profiled, specified
400 either as a pathname or a soname. Profiling output is appended
401 to the file whose name is: "$LD_PROFILE_OUTPUT/$LD_PROFILE.pro‐
402 file".
403 Since glibc 2.2.5, LD_PROFILE is ignored in secure-execution
405 mode.
406 LD_PROFILE_OUTPUT (since glibc 2.1)
408 Directory where LD_PROFILE output should be written. If this
409 variable is not defined, or is defined as an empty string, then
410 the default is /var/tmp.
411 LD_PROFILE_OUTPUT is ignored in secure-execution mode; instead
413 /var/profile is always used. (This detail is relevant only
414 before glibc 2.2.5, since in later glibc versions, LD_PROFILE is
415 also ignored in secure-execution mode.)
416 LD_SHOW_AUXV (since glibc 2.1)
418 If this environment variable is defined (with any value), show
419 the auxiliary array passed up from the kernel (see also getaux‐
420 val(3)).
421 Since glibc 2.3.4, LD_SHOW_AUXV is ignored in secure-execution
423 mode.
424 LD_TRACE_PRELINKING (since glibc 2.4)
426 If this environment variable is defined, trace prelinking of the
427 object whose name is assigned to this environment variable.
428 (Use ldd(1) to get a list of the objects that might be traced.)
429 If the object name is not recognized, then all prelinking activ‐
430 ity is traced.
431 LD_USE_LOAD_BIAS (since glibc 2.3.3)
433 By default (i.e., if this variable is not defined), executables
434 and prelinked shared objects will honor base addresses of their
435 dependent shared objects and (nonprelinked) position-independent
436 executables (PIEs) and other shared objects will not honor them.
437 If LD_USE_LOAD_BIAS is defined with the value 1, both executa‐
438 bles and PIEs will honor the base addresses. If
439 LD_USE_LOAD_BIAS is defined with the value 0, neither executa‐
440 bles nor PIEs will honor the base addresses.
441 Since glibc 2.3.3, this variable is ignored in secure-execution
443 mode.
444 LD_VERBOSE (since glibc 2.1)
446 If set to a nonempty string, output symbol versioning informa‐
447 tion about the program if the LD_TRACE_LOADED_OBJECTS environ‐
448 ment variable has been set.
449 LD_WARN (since glibc 2.1.3)
451 If set to a nonempty string, warn about unresolved symbols.
452 LD_PREFER_MAP_32BIT_EXEC (x86-64 only; since glibc 2.23)
454 According to the Intel Silvermont software optimization guide,
455 for 64-bit applications, branch prediction performance can be
456 negatively impacted when the target of a branch is more than
457 4 GB away from the branch. If this environment variable is set
458 (to any value), the dynamic linker will first try to map exe‐
459 cutable pages using the mmap(2) MAP_32BIT flag, and fall back to
460 mapping without that flag if that attempt fails. NB: MAP_32BIT
461 will map to the low 2 GB (not 4 GB) of the address space.
462 Because MAP_32BIT reduces the address range available for
464 address space layout randomization (ASLR), LD_PRE‐
465 FER_MAP_32BIT_EXEC is always disabled in secure-execution mode.
466
468 /lib/ld.so
469 a.out dynamic linker/loader
470 /lib/ld-linux.so.{1,2}
471 ELF dynamic linker/loader
472 /etc/ld.so.cache
473 File containing a compiled list of directories in which to
474 search for shared objects and an ordered list of candidate
475 shared objects. See ldconfig(8).
476 /etc/ld.so.preload
477 File containing a whitespace-separated list of ELF shared
478 objects to be loaded before the program. See the discussion of
479 LD_PRELOAD above. If both LD_PRELOAD and /etc/ld.so.preload are
480 employed, the libraries specified by LD_PRELOAD are preloaded
481 first. /etc/ld.so.preload has a system-wide effect, causing the
482 specified libraries to be preloaded for all programs that are
483 executed on the system. (This is usually undesirable, and is
484 typically employed only as an emergency remedy, for example, as
485 a temporary workaround to a library misconfiguration issue.)
486 lib*.so*
487 shared objects
488
490 Hardware capabilities
491 Some shared objects are compiled using hardware-specific instructions
492 which do not exist on every CPU. Such objects should be installed in
493 directories whose names define the required hardware capabilities, such
494 as /usr/lib/sse2/. The dynamic linker checks these directories against
495 the hardware of the machine and selects the most suitable version of a
496 given shared object. Hardware capability directories can be cascaded
497 to combine CPU features. The list of supported hardware capability
498 names depends on the CPU. The following names are currently recog‐
499 nized:
500 Alpha ev4, ev5, ev56, ev6, ev67
502 MIPS loongson2e, loongson2f, octeon, octeon2
504 PowerPC
506 4xxmac, altivec, arch_2_05, arch_2_06, booke, cellbe, dfp, efp‐
507 double, efpsingle, fpu, ic_snoop, mmu, notb, pa6t, power4,
508 power5, power5+, power6x, ppc32, ppc601, ppc64, smt, spe,
509 ucache, vsx
510 SPARC flush, muldiv, stbar, swap, ultra3, v9, v9v, v9v2
512 s390 dfp, eimm, esan3, etf3enh, g5, highgprs, hpage, ldisp, msa,
514 stfle, z900, z990, z9-109, z10, zarch
515 x86 (32-bit only)
517 acpi, apic, clflush, cmov, cx8, dts, fxsr, ht, i386, i486, i586,
518 i686, mca, mmx, mtrr, pat, pbe, pge, pn, pse36, sep, ss, sse,
519 sse2, tm
520
522 ld(1), ldd(1), pldd(1), sprof(1), dlopen(3), getauxval(3), elf(5),
523 capabilities(7), rtld-audit(7), ldconfig(8), sln(8)
524
526 This page is part of release 5.02 of the Linux man-pages project. A
527 description of the project, information about reporting bugs, and the
528 latest version of this page, can be found at
529 https://www.kernel.org/doc/man-pages/.
530GNU 2019-08-02 LD.SO(8)