Debian Bug report logs - #395177
libc6: default library search path is inconsistent with gcc

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Vincent Lefevre <vincent@vinc17.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libc6: default library search path is inconsistent with gcc

Date: Wed, 25 Oct 2006 14:37:04 +0200

Package: libc6
Version: 2.3.6.ds1-7
Severity: normal

(Not sure if this is a bug in libc6 or binutils or another package;
I first thought it was a bug in gcc, but a gcc developer said no:
<http://gcc.gnu.org/bugzilla/show_bug.cgi?id=29588>.)

gcc has /usr/local/include in its default search path, i.e. without
setting any special environment variable. Therefore, in order to be
consistent, the linker should have /usr/local/lib is its search path
too, *by default*.

Here's a way to reproduce the problem (just an example):

  0. Make sure you have default *PATH settings (i.e. no C_INCLUDE_PATH,
     no LIBRARY_PATH, no LD_LIBRARY_PATH set to some value).

  1. Install the official GMP packages, so that one has GMP 4.2.1
     files installed in /usr/include and /usr/lib directories.

  2. Download GMP 4.2.1 and replace the __GNU_MP_VERSION_PATCHLEVEL
     value, e.g. by 17.

  3. Build and install GMP 4.2.17 with configure, make, make install
     (install-nodist_includeexecHEADERS and install-libLTLIBRARIES
     are sufficient).

  4. Compile the following program with either:

       gcc -Wall gmpversion.c -o gmpversion -lgmp

or

       gcc -Wall -static gmpversion.c -o gmpversion -lgmp

#include <stdio.h>
#include <gmp.h>
int main (void)
{
  printf ("GMP .....  Library: %-6s -  Header: %d.%d.%d\n",
          gmp_version, __GNU_MP_VERSION, __GNU_MP_VERSION_MINOR,
          __GNU_MP_VERSION_PATCHLEVEL);
  return 0;
}

  5. Run it. You should get:

GMP .....  Library: 4.2.1  -  Header: 4.2.17

This is an incorrect behavior. With default settings, one should get
the same header and library versions (whether this is 4.2.1 or 4.2.17,
I don't care, this is just a policy matter).

A solution could be: add /usr/local/lib to /etc/ld.so.conf by default.

I've not tried, though. I hope this fixes the behavior with libtool
too. But I don't know about the -static option (perhaps a bug in ld,
thus in the binutils package?).

Note: because of this problem, we get bug reports for our software
because of inconsistent header and library versions. This is a problem
with GMP in particular as GMP 4.1.4 (from Debian/stable) and GMP 4.2.1
are incompatible.

-- System Information:
Debian Release: testing/unstable
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.18-1-686-bigmem
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.ISO8859-1 (charmap=ISO-8859-1)

Versions of packages libc6 depends on:
ii  tzdata                        2006n-1    Time Zone and Daylight Saving Time

libc6 recommends no packages.

-- no debconf information

Message #10 received at submit@bugs.debian.org (full text, mbox, reply):

From: Gabor Gombas <gombasg@sztaki.hu>

To: Vincent Lefevre <vincent@vinc17.org>, 395177@bugs.debian.org

Cc: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: Re: Bug#395177: libc6: default library search path is inconsistent with gcc

Date: Fri, 27 Oct 2006 10:33:53 +0200

On Wed, Oct 25, 2006 at 02:37:04PM +0200, Vincent Lefevre wrote:

>   5. Run it. You should get:
> 
> GMP .....  Library: 4.2.1  -  Header: 4.2.17

This means the soname of gmp 4.2.1 and 4.2.17 is the same (or you'd have
got an "error while loading shared libraries ..." message). But that
also means that adding /usr/local/lib to /etc/ld.so.conf would _NOT_
solve your problem since the loader would still find libgmp.so.X in
/usr/lib first.

If you want to have two different shared libraries sharing the same
soname on the same system, then there is no other solution than setting
LD_LIBRARY_PATH to point explicitely to the version you want to use.

Gabor

-- 
     ---------------------------------------------------------
     MTA SZTAKI Computer and Automation Research Institute
                Hungarian Academy of Sciences
     ---------------------------------------------------------

Message #20 received at 395177@bugs.debian.org (full text, mbox, reply):

From: Vincent Lefevre <vincent@vinc17.org>

To: Gabor Gombas <gombasg@sztaki.hu>

Cc: 395177@bugs.debian.org

Subject: Re: Bug#395177: libc6: default library search path is inconsistent with gcc

Date: Fri, 27 Oct 2006 11:25:51 +0200

On 2006-10-27 10:33:53 +0200, Gabor Gombas wrote:
> On Wed, Oct 25, 2006 at 02:37:04PM +0200, Vincent Lefevre wrote:
> 
> >   5. Run it. You should get:
> > 
> > GMP .....  Library: 4.2.1  -  Header: 4.2.17
> 
> This means the soname of gmp 4.2.1 and 4.2.17 is the same (or you'd
> have got an "error while loading shared libraries ..." message).

Not necessarily. The soname isn't defined in the header file, is it?
(At compile time, it seems that the library was also 4.2.1, because
I get the same problem when using -static, i.e., by not using shared
libraries.)

> But that also means that adding /usr/local/lib to /etc/ld.so.conf
> would _NOT_ solve your problem since the loader would still find
> libgmp.so.X in /usr/lib first.

So, couldn't the dynamic loader take into account /usr/local/lib
by default (before /usr/lib), just like cpp takes into account
/usr/local/include by default (before /usr/include)?

> If you want to have two different shared libraries sharing the same
> soname on the same system, then there is no other solution than setting
> LD_LIBRARY_PATH to point explicitely to the version you want to use.

If this is really the only possibility, it should probably be set
in /etc/profile in the default configuration (at install time) and
other shell init files.

-- 
Vincent Lefèvre <vincent@vinc17.org> - Web: <http://www.vinc17.org/>
100% accessible validated (X)HTML - Blog: <http://www.vinc17.org/blog/>
Work: CR INRIA - computer arithmetic / Arenaire project (LIP, ENS-Lyon)

Message #25 received at 395177@bugs.debian.org (full text, mbox, reply):

From: Gabor Gombas <gombasg@sztaki.hu>

To: Vincent Lefevre <vincent@vinc17.org>, 395177@bugs.debian.org

Subject: Re: Bug#395177: libc6: default library search path is inconsistent with gcc

Date: Fri, 27 Oct 2006 14:09:59 +0200

On Fri, Oct 27, 2006 at 11:25:51AM +0200, Vincent Lefevre wrote:

> Not necessarily. The soname isn't defined in the header file, is it?
> (At compile time, it seems that the library was also 4.2.1, because
> I get the same problem when using -static, i.e., by not using shared
> libraries.)

Build-time linking has nothing to do with glibc. Besides, ld _does_
search /usr/local/lib before /usr/lib by default.

> > But that also means that adding /usr/local/lib to /etc/ld.so.conf
> > would _NOT_ solve your problem since the loader would still find
> > libgmp.so.X in /usr/lib first.
> 
> So, couldn't the dynamic loader take into account /usr/local/lib
> by default (before /usr/lib), just like cpp takes into account
> /usr/local/include by default (before /usr/include)?

That would be a security nightmare as /usr/local is often writable/owned
by users other than root (for example, looking at my etch chroot, it is
writable by group 'staff' by default). Btw., this is also one of the
many reasons why compiling software as root is generally considered
insecure and discouraged.

> If this is really the only possibility, it should probably be set
> in /etc/profile in the default configuration (at install time) and
> other shell init files.

That would be a security problem as well. Only the local system
administrator can decide whether things installed in /usr/local should
override system software or not.

Gabor

-- 
     ---------------------------------------------------------
     MTA SZTAKI Computer and Automation Research Institute
                Hungarian Academy of Sciences
     ---------------------------------------------------------

Message #30 received at 395177@bugs.debian.org (full text, mbox, reply):

From: Vincent Lefevre <vincent@vinc17.org>

To: Gabor Gombas <gombasg@sztaki.hu>

Cc: 395177@bugs.debian.org

Subject: Re: Bug#395177: libc6: default library search path is inconsistent with gcc

Date: Fri, 27 Oct 2006 15:20:20 +0200

On 2006-10-27 14:09:59 +0200, Gabor Gombas wrote:
> On Fri, Oct 27, 2006 at 11:25:51AM +0200, Vincent Lefevre wrote:
> > Not necessarily. The soname isn't defined in the header file, is it?
> > (At compile time, it seems that the library was also 4.2.1, because
> > I get the same problem when using -static, i.e., by not using shared
> > libraries.)
> 
> Build-time linking has nothing to do with glibc.

Yep, but I could assign the bug only to one package.

> Besides, ld _does_ search /usr/local/lib before /usr/lib by default.

So, why do I obtain the same result with -static (i.e., with the
library from /usr/lib instead of /usr/local/lib)?

> > So, couldn't the dynamic loader take into account /usr/local/lib
> > by default (before /usr/lib), just like cpp takes into account
> > /usr/local/include by default (before /usr/include)?
> 
> That would be a security nightmare as /usr/local is often writable/owned
> by users other than root (for example, looking at my etch chroot, it is
> writable by group 'staff' by default).

One should assume that users of the 'staff' group are responsible.
And there would be the same security risks for programs compiled
and installed on the system. So, if you decide that /usr/local/lib
shouldn't be in the search paths by default, then this should be
the same for /usr/local/include.

Also, due to software installed in /usr/local (the default prefix
with "configure"), users often need to add /usr/local/lib to
LD_LIBRARY_PATH anyway.

> > If this is really the only possibility, it should probably be set
> > in /etc/profile in the default configuration (at install time) and
> > other shell init files.
> 
> That would be a security problem as well. Only the local system
> administrator can decide whether things installed in /usr/local should
> override system software or not.

Why does gcc search for include files in /usr/local/include before
/usr/include (on Linux machines), then?

-- 
Vincent Lefèvre <vincent@vinc17.org> - Web: <http://www.vinc17.org/>
100% accessible validated (X)HTML - Blog: <http://www.vinc17.org/blog/>
Work: CR INRIA - computer arithmetic / Arenaire project (LIP, ENS-Lyon)

Message #35 received at 395177-close@bugs.debian.org (full text, mbox, reply):

From: Aurelien Jarno <aurel32@debian.org>

To: 395177-close@bugs.debian.org

Subject: Bug#395177: fixed in glibc 2.6-3

Date: Mon, 23 Jul 2007 09:02:11 +0000

Source: glibc
Source-Version: 2.6-3

We believe that the bug you reported is fixed in the latest version of
glibc, which is due to be installed in the Debian FTP archive:

glibc-doc_2.6-3_all.deb
  to pool/main/g/glibc/glibc-doc_2.6-3_all.deb
glibc_2.6-3.diff.gz
  to pool/main/g/glibc/glibc_2.6-3.diff.gz
glibc_2.6-3.dsc
  to pool/main/g/glibc/glibc_2.6-3.dsc
libc6-dbg_2.6-3_amd64.deb
  to pool/main/g/glibc/libc6-dbg_2.6-3_amd64.deb
libc6-dev-i386_2.6-3_amd64.deb
  to pool/main/g/glibc/libc6-dev-i386_2.6-3_amd64.deb
libc6-dev_2.6-3_amd64.deb
  to pool/main/g/glibc/libc6-dev_2.6-3_amd64.deb
libc6-i386_2.6-3_amd64.deb
  to pool/main/g/glibc/libc6-i386_2.6-3_amd64.deb
libc6-pic_2.6-3_amd64.deb
  to pool/main/g/glibc/libc6-pic_2.6-3_amd64.deb
libc6-prof_2.6-3_amd64.deb
  to pool/main/g/glibc/libc6-prof_2.6-3_amd64.deb
libc6-udeb_2.6-3_amd64.udeb
  to pool/main/g/glibc/libc6-udeb_2.6-3_amd64.udeb
libc6_2.6-3_amd64.deb
  to pool/main/g/glibc/libc6_2.6-3_amd64.deb
libnss-dns-udeb_2.6-3_amd64.udeb
  to pool/main/g/glibc/libnss-dns-udeb_2.6-3_amd64.udeb
libnss-files-udeb_2.6-3_amd64.udeb
  to pool/main/g/glibc/libnss-files-udeb_2.6-3_amd64.udeb
locales-all_2.6-3_amd64.deb
  to pool/main/g/glibc/locales-all_2.6-3_amd64.deb
locales_2.6-3_all.deb
  to pool/main/g/glibc/locales_2.6-3_all.deb
nscd_2.6-3_amd64.deb
  to pool/main/g/glibc/nscd_2.6-3_amd64.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 395177@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Aurelien Jarno <aurel32@debian.org> (supplier of updated glibc package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 23 Jul 2007 08:01:26 +0200
Source: glibc
Binary: libc0.1-prof libc6-dev-amd64 locales-all libc6-i686 libc6-dev-ppc64 libc0.3-pic glibc-doc libc0.3 libc6-dev-mipsn32 libc0.1-i686 libc0.1-i386 libc6-mips64 libc6.1-dev libc6-s390x libnss-files-udeb libc0.1-dev-i386 libc6-dev-sparc64 libc6-i386 libc0.3-dev libc6-udeb libc6-dbg libc6.1-pic libc6-dev libc0.3-prof libc0.1-udeb libc6-dev-i386 libc6.1-prof libc6-mipsn32 libc0.1-dev locales libc6-pic libc0.3-udeb libc6-dev-powerpc libc0.1-pic libc6-ppc64 libc0.3-dbg libc0.1-dbg libc6-amd64 libc0.1 libc6-prof libc6-xen libc6-dev-mips64 libc6-powerpc libc6 libc6-sparcv9b libc6.1-udeb libc6.1-dbg nscd libc6-sparc64 libnss-dns-udeb libc6.1 libc6-dev-s390x
Architecture: source amd64 all
Version: 2.6-3
Distribution: unstable
Urgency: low
Maintainer: Aurelien Jarno <aurel32@debian.org>
Changed-By: Aurelien Jarno <aurel32@debian.org>
Description: 
 glibc-doc  - GNU C Library: Documentation
 libc6      - GNU C Library: Shared libraries
 libc6-dbg  - GNU C Library: Libraries with debugging symbols
 libc6-dev  - GNU C Library: Development Libraries and Header Files
 libc6-dev-i386 - GNU C Library: 32bit development libraries for AMD64
 libc6-i386 - GNU C Library: 32bit shared libraries for AMD64
 libc6-pic  - GNU C Library: PIC archive library
 libc6-prof - GNU C Library: Profiling Libraries
 libc6-udeb - GNU C Library: Shared libraries - udeb (udeb)
 libnss-dns-udeb - GNU C Library: NSS helper for DNS - udeb (udeb)
 libnss-files-udeb - GNU C Library: NSS helper for files - udeb (udeb)
 locales    - GNU C Library: National Language (locale) data [support]
 locales-all - GNU C Library: Precompiled locale data
 nscd       - GNU C Library: Name Service Cache Daemon
Closes: 395177 396135 413744 432721 433962
Changes: 
 glibc (2.6-3) unstable; urgency=low
 .
   [ Aurelien Jarno ]
   * script.in/kernelcheck.sh: s/kernel_compare_version/linux_compare_versions/
     for arm.
   * script.in/kernelcheck.sh: the minimum kernel version is now 2.6.8 and not
     2.6.1.  Closes: bug#432721.
   * hppa/submitted-threaddb.diff: new patch from Randolph Chung to fix
     debugging interface for NPTL on hppa.
   * Drop SPARC V8 support:
     - control.in/opt: drop libc6-sparcv9.
     - sysdeps/sparc.mk: drop libc6-sparcv9.
     - script.in/kernelcheck.sh: add check for SPARC V8 or earlier CPU.
     - patches/series: disable sparc/submitted-timing.diff.
     - patches/sparc/local-sparcv8-target.diff: rename to
       local-sparcv9-target.diff and default to v9.
   * Build with gcc-4.2 except on alpha (untested).
   * patches/any/cvs-ld_library_path.diff: new patch from CVS to fix segfaults
     with empty LD_LIBRARY_PATH variable.
   * rules.d/build.mk: create /etc/ld.so.conf.d/libc.conf to add
     /usr/local/lib as a default search path.  Closes: #395177.
   * Honor parallel= option in DEB_BUILD_OPTIONS.  Closes: #413744.
 .
   [ Pierre Habouzit ]
   * rules.d/debhelper.mk: add some magic to copy debian/bug/$pkg/ files into
     /usr/share/bug/.
   * add libc6-i386/presubj to document /usr/lib32 issues not being a
     libc6-i386 problem.
   * add locales/presubj about locales depends that are correct, and tell bug
     reporters how to look for their package being built or not.
   * add patches/any/local-missing-linux_types.h.diff to add missing
     #include <linux/types.h> due to migration to linux-libc-dev.
     Closes: #433962.
 .
   [ Samuel Thibault ]
   * hurd-i386/local-tls-support.diff: new patch to support TLS.
   * debian/sysdeps/hurd.mk (libc_extra_config_options): Removed
     --without-__thread, --without-tls and libc_cv_z_relro=no.
   * hurd-i386/local-atomic-no-multiple_threads.diff: new patch, hurd-i386
     doesn't need the multiple_threads field.
   * hurd-i386/local-gscope.diff: new patch, backport of the CVS global scope.
   * hurd-i386/local-no-strerror_l.diff: new patch to disable non-implemented
     strerror_l().
   * hurd-i386/submitted-lock-intern.diff: new patch to fix a header inclusion.
   * sysdeps/depflags.pl: make libc0.3 depend on TLS-enabled hurd packages.
   * hurd-i386/local-sigsuspend-nocancel.diff: renamed into
     submitted-sigsuspend-nocancel.diff.
   * hurd-i386/submitted-ECANCELED.diff: new patch to fix ECANCELED value.
     Closes: #396135.
   * hurd-i386/local-gcc-4.1-init-first.diff: New patch by Thomas
     Schwinge to fix building with gcc-4.1.
   * sysdeps/hurd.mk (CC, BUILD_CC): Change to gcc-4.1.
   * control: Depend on gcc-4.1 on hurd-i386.
Files: 
 9b9dcb2b7bfa1fa49db3bd1e9a30d85b 2301 libs required glibc_2.6-3.dsc
 45339d4b800388c08623c0edafcb0bc2 674907 libs required glibc_2.6-3.diff.gz
 b2cc24f9c2cf7946a2406a533419c4a1 1629660 doc optional glibc-doc_2.6-3_all.deb
 28a4f70a492c71911449207b71949e73 4430408 libs standard locales_2.6-3_all.deb
 79936cc025f188570a2a90dded477ca0 4905024 libs required libc6_2.6-3_amd64.deb
 ce4b300edfb96dece2e894e27086ba63 2489424 libdevel optional libc6-dev_2.6-3_amd64.deb
 7fac138c04c204b80b402ee5fc163c53 1926092 libdevel extra libc6-prof_2.6-3_amd64.deb
 122b517f53ba4e812d18819c9d295532 1462180 libdevel optional libc6-pic_2.6-3_amd64.deb
 396014686dd3e3cccffd60e6b990792e 2502120 libs extra locales-all_2.6-3_amd64.deb
 d24f4ca214bc4ab385b7c5a7ff086c62 3704948 libs optional libc6-i386_2.6-3_amd64.deb
 258f0746239e96a165bda4dd41d71917 1880478 libdevel optional libc6-dev-i386_2.6-3_amd64.deb
 ff519d0e596dd34236ab8dc3a7bb8b3b 162564 admin optional nscd_2.6-3_amd64.deb
 6f1ac46ac05ea67f71dbde727a200523 10535462 libdevel extra libc6-dbg_2.6-3_amd64.deb
 bebf41d72f2074ef3de56d5cccfa0faa 1108868 debian-installer extra libc6-udeb_2.6-3_amd64.udeb
 778768ef57dba315c287baab8eeba52f 9728 debian-installer extra libnss-dns-udeb_2.6-3_amd64.udeb
 80c869e103093c383906af85cf05b46a 17876 debian-installer extra libnss-files-udeb_2.6-3_amd64.udeb
Package-Type: udeb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGpGFSw3ao2vG823MRAlCaAJ4wfDD1oqchK/b4iq7Me7vktV5ukgCfUQJl
e86aFxLXFmxzggaP/ikE6Pk=
=Onmr
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.