Re: RFC: Should the linker warn about and/or control the propagation of audit libraries ?

On Thu, Jul 30, 2026 at 4:15=E2=80=AFAM Nick Clifton <[email protected]> wro=
te:
>
> Hi Sam,
>
> > I'm not sure I see a problem: the same issue exists with ELF
> > constructors without DT_AUDIT.
>
> Do these constructors have the potential to intercept and change
> symbol resolution though ?  I think that the issue is that audit
> libraries are potentially able to perform very low level manipulation
> of the run time environment, and so should be used with caution.
>
>
> > That said, the use of DT_AUDIT is so unusual that I'd find a message
> > about it slightly interesting.
>
> I must admit that I would be interested in seeing if there any
> projects out there that are using audit libraries for anything
> other than debugging or profiling purposes.

My old project falls under that category (neither debugging or profiling),
Its gcc plugin needs to be updated for modern gcc in c++, and uploaded some=
where
was previously available on gitorious but that is long gone.

The gcc plugin adds the equivalent to mac os's c compiler `-framework`
command line option to their
gcc. For the compiler it affects preprocessor search path, link paths
for the linker,
and the things linked are embedded with a custom elf substitution sequence.
The actual substitutions are done by an audit library.

Seems like it'll take a bit before I can get it working on a modern system =
tho.

It's just a different style of linking that instead of linking to
/usr/lib/libfoo.so
links to /path/to/foo.framework/libfoo.so and preprocesses
foo.framework/Headers/foo.h so Instead of having includes in
/usr/include in separate
paths all of the resources are available from a single install directory.

So it links to things like:
readelf -d test-exec | grep -E '(NEEDED|AUDIT)'
 0x0000000000000001 (NEEDED)             Shared library:
[${framework}/test.framework/libtest.so]

and then (the audit library) replaces the ${framework} subst seq with
e.g. /path/to.
DT_AUDIT/DT_DEPAUDIT just make it so that you don't need environment variab=
les
set to execute the library.


> Cheers
>    Nick
>
>
>