[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <E944313E-3CE7-48D0-B4D4-8DCB26C41D33@wsu.edu>
Date: Sat, 7 Nov 2026 06:28:24 +0000
From: "Ammanaghatta Shivakumar, Basavesh" <basavesh.shivakumar@....edu>
To: "musl@...ts.openwall.com" <musl@...ts.openwall.com>
CC: "Priya, Swarn" <swarn.priya@....edu>
Subject: explicit-path `dlopen` does not satisfy later `DT_NEEDED` by SONAME
Hello,
This is a concrete follow-up to the already-public discussion of musl's loaded
object identity rules.
If a DSO with `DT_SONAME=libprov.so` is first loaded by an explicit pathname,
musl does not record the SONAME as a reusable name. A plugin loaded afterward
has `DT_NEEDED=libprov.so`; musl searches the plugin's RUNPATH and loads a
second same-SONAME DSO. glibc reuses the object already loaded by explicit
path. Loading the first object by basename is a musl control and also reuses
it.
## Reproducer
This requires `clang`, `musl-gcc`, and glibc on the same x86-64 system.
```sh
set -eu
mkdir musl-soname-repro
cd musl-soname-repro
mkdir bundled fallback plugin bin
cat > bundled.c <<'EOF'
static const char id[] = "bundled";
int prov(void) { return 17; }
const char *provider_id(void) { return id; }
EOF
cat > fallback.c <<'EOF'
static const char id[] = "fallback";
int prov(void) { return 29; }
const char *provider_id(void) { return id; }
EOF
cat > plugin.c <<'EOF'
extern int prov(void);
extern const char *provider_id(void);
int run(void) { return prov(); }
const char *which(void) { return provider_id(); }
EOF
cat > runner.c <<'EOF'
#define _GNU_SOURCE
#include <dlfcn.h>
#include <stdio.h>
typedef int (*run_t)(void);
typedef const char *(*which_t)(void);
int main(int argc, char **argv) {
if (argc != 3) return 100;
void *first = dlopen(argv[1], RTLD_NOW | RTLD_LOCAL);
if (!first) { fprintf(stderr, "first: %s\n", dlerror()); return 101; }
void *plug = dlopen(argv[2], RTLD_NOW | RTLD_LOCAL);
if (!plug) { fprintf(stderr, "plugin: %s\n", dlerror()); return 102; }
run_t run = (run_t)dlsym(plug, "run");
which_t which = (which_t)dlsym(plug, "which");
printf("provider=%s result=%d\n", which(), run());
return 0;
}
EOF
clang -O2 -fPIC -c bundled.c fallback.c plugin.c
clang -shared -nostdlib -Wl,-soname,libprov.so \
bundled.o -o bundled/libprov.so
clang -shared -nostdlib -Wl,-soname,libprov.so \
fallback.o -o fallback/libprov.so
clang -shared -nostdlib plugin.o -Lbundled -lprov \
'-Wl,-rpath,$ORIGIN/../fallback' -o plugin/libplugin.so
clang -O2 -no-pie runner.c -ldl -o bin/runner-glibc
musl-gcc -O2 -no-pie runner.c -ldl -o bin/runner-musl
echo '== musl explicit path'
bin/runner-musl "$PWD/bundled/libprov.so" "$PWD/plugin/libplugin.so"
echo '== glibc explicit path'
bin/runner-glibc "$PWD/bundled/libprov.so" "$PWD/plugin/libplugin.so"
echo '== musl basename control'
LD_LIBRARY_PATH="$PWD/bundled" \
bin/runner-musl libprov.so "$PWD/plugin/libplugin.so"
```
Observed with musl 1.2.5 and current head:
```text
== musl explicit path
provider=fallback result=29
== glibc explicit path
provider=bundled result=17
== musl basename control
provider=bundled result=17
```
## Current head and source cause
The exact retained musl-head run is commit
`7813e9119eb5fe681b6750b8a033a0490bca0941`, which is still current as of
2026-11-06. In `ldso/dynlink.c`, `load_library` compares `shortname` for
requests without `/` and populates `shortname` only when the input name was
resolved through a search. An explicit pathname does not gain its `DT_SONAME`
as an alias for later dependency lookup.
The general behavior has already been discussed publicly in 2021, 2022, and
2025, including the maintainer response that honoring `DT_SONAME` should be
revisited. This message adds a small deterministic reproducer and does not
claim novelty for the root behavior or request a security embargo.
An LLM assisted with reducing the reproducer, checking current source, and
drafting this message. I ran the retained current-head reproduction and
reviewed the claims.
Regards,
Basavesh & Swarn
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
