Detecting fake library versions

Matthew Seaman m.seaman at
Thu Jun 17 15:37:03 UTC 2010

Hash: SHA1

On 17/06/2010 16:04:20, Warren Block wrote:
>> This is not generally true for shlibs installed from ports, mostly due
>> to the prevalence of linuxisms like ABI version numbers that aren't
>> simple integers.  Even so, applying a little intelligent scrutiny to the
>> list of results will help you sort out any spurious linkage.
> Could you expand on this part?
> find reports 83 links in /usr/local/lib.  But only the fake
> is linked to a port-created library but not recorded as part of the
> gettext package.

Right.  In /usr/local/lib on one machine I happen to have the following:

% find /usr/local/lib -name '*.so.*' -type l -ls | cut -c 89-
/usr/local/lib/ ->
/usr/local/lib/ ->
/usr/local/lib/ ->
/usr/local/lib/ ->
/usr/local/lib/ ->
/usr/local/lib/ -> db48/
/usr/local/lib/ -> db48/
/usr/local/lib/ ->
/usr/local/lib/ -> /usr/local/lib/
/usr/local/lib/ ->
/usr/local/lib/ ->
/usr/local/lib/ ->
/usr/local/lib/ ->
/usr/local/lib/ -> lua51/
/usr/local/lib/ ->

You can see several different patterns here.

Primus: like or --- the shlib is
installed into a sub-dir of /usr/local/lib and linked back into the main
directory.  This is generally used when there are several different
versions of the particular library available in ports.

Secondus: like, -- for some reason, the file is
installed with the ABI version as part of the basename of the file and
the link just provides the expected name.

Tertius: like and pretty much all the rest.  *BSD uses
.38 as the ABI version number, whereas linux seems to prefer .38.1 --
occasionally this sort of thing is the result of developers being
unclear on the concept of an ABI version number, and just using their
main code version number.

These are all perfectly normal and as installed from ports -- a little
work with 'pkg_which' and 'pkg_info -g' will demonstrate that.

On the other hand, if I'd seen:

/usr/local/lib/ ->

where there is a shlib with the standard ABI version pattern as expected
under *BSD, but it's a link to another shlib with a *different* major
version number, then it's pretty clear someone has been bodging things.

Clear enough?



- -- 
Dr Matthew J Seaman MA, D.Phil.                   7 Priory Courtyard
                                                  Flat 3
PGP:     Ramsgate
JID: matthew at               Kent, CT11 9PW
Version: GnuPG/MacGPG2 v2.0.14 (Darwin)
Comment: Using GnuPG with Mozilla -


More information about the freebsd-questions mailing list