# [solved] unexpected changes in files under /lib

## toralf

My daily backup (rsync) today brought this transfers into my eyes :

```
===================================

/lib

cd..t...... lib/

>f.s....... lib/ld-2.15.so

>f.s....... lib/libblkid.so.1.1.0

>f.s....... lib/libc-2.15.so

>f.s....... lib/libcrypt-2.15.so

...

```

which where partly unexpected. I checked one of those candidates file, it  belongs to glibc :

```
$ equery b libdl-2.15.so                                                                                                                     

 * Searching for libdl-2.15.so ...                                                                                                                                    

sys-libs/glibc-2.15-r3 (/lib/libdl-2.15.so)     

```

and was emerged last time at :

```
$ genlop glibc | tail -n 2

     Sun Oct 21 17:38:34 2012 >>> sys-libs/glibc-2.15-r3

```

Now me wonders about these changes :

```
$ ls -l /mnt/media/daily/20121130-175932/lib/libdl-2.15.so /mnt/media/monthly/20121127-220336/lib/libdl-2.15.so

-rwxr-xr-x 1 root root 15692 Oct 21 17:37 /mnt/media/daily/20121130-175932/lib/libdl-2.15.so

-rwxr-xr-x 5 root root 13884 Oct 21 17:37 /mnt/media/monthly/20121127-220336/lib/libdl-2.15.so

```

which of course yields into diffs here too :

```
$ md5sum /mnt/media/daily/20121130-175932/lib/libdl-2.15.so /mnt/media/monthly/20121127-220336/lib/libdl-2.15.so

f707a31d68875fc74bc57a0046240967  /mnt/media/daily/20121130-175932/lib/libdl-2.15.so

b2a5edf72d18251f16db6660ffeaf597  /mnt/media/monthly/20121127-220336/lib/libdl-2.15.so

```

Now /me wonders where to start / how to continue. FWIW I omploaded [/b]both the old http://ompldr.org/vZ2lkYg and the current file http://ompldr.org/vZ2lkYw here.

Update:

I made an 

```
$ objdump -D /lib/libdl-2.15.so | nl -ba > current 

$ objdump -D libdl-2.15.so | nl -ba > old

```

and found changed addresses :

```
$ egrep "^     7" old current 

old    :     7  00000174 <.note.ABI-tag>:

current:     7  46b41174 <.note.ABI-tag>:

```

and a lot of diffs, starting at line line 325 :

```
current:   325  46b4157d:       25 b4 46 43 00          and    $0x4346b4,%eax

```

versus

```
old:   325       57d:   15 00 00 43 00          adc    $0x430000,%eax
```

Last edited by toralf on Sat Dec 01, 2012 7:50 pm; edited 7 times in total

----------

## Etal

I have the opposite: I emerged glibc in August, but the timestamp says libdl was last modified in May:

```
$ genlop glibc | tail -n 2 

     Thu Aug  9 21:06:05 2012 >>> sys-libs/glibc-2.15-r2

$ ls -l /lib/libdl-2.15.so

-rwxr-xr-x 1 root root 14624 May 22  2012 /lib/libdl-2.15.so
```

----------

## Flameeyes

Let's start from the top. There are only three tools that can legitimately change an ELF file (okay maybe four but I'll go into that later): strip, chpax/paxctl, and prelink. The first is designed to remove debug information, and Portage already runs it on files before the livefs merge. The second (actually two tools, but one is the new one) is for hardened, and is not going to be deprecated in favour of using xattr marking, and the third is a way to try to reduce the overhead of running programs. For more information about the third I'll point you to my blog's tag as I've written quite enough on the subject.

In your case, the latter is what caused the change; if you compare the two files with a more simple 'readelf -S' instead of a full blown objdump, you can see that the new file has three new sections that are not present in the old one: .gnu.liblist .gnu.libstr and .gnu.prelink_undo. These three sections are where the extra space is coming from.

P.S.: the fourth tool I refer to above is chrpath, but that's only used to change the runtime search path for proprietary software, almost exclusively, so it really can't apply go glibc.

----------

## toralf

right - prelink is the reason.

Thx

----------

