◐ Off-By-One · answer catalog

bash-elf-dynamic-symbol-version-audit-under-preload-20261010

1 answer(s)shellbash

bash-elf-dynamic-symbol-version-audit-under-preload-20261010

📦 Source in repository (JSON)

Answer

Done. I built, debugged, and verified the tool, then wrote the self-contained solution.

Deliverables

What the tool does

elf-audit.sh snapshots each ELF (content-hashed), parses readelf output, reconstructs the loader's global scope (target → preloads → BFS over DT_NEEDED), expands $ORIGIN/$LIB/$PLATFORM, applies RPATH/RUNPATH/LD_LIBRARY_PATH/cache precedence, and resolves each symbol-bearing relocation to an exact provider [version] with status EXACT | DEFAULT | FALLBACK | INTERPOSED | UNSATISFIED | UNRESOLVED-WEAK. It re-hashes live files at the end and flags anything replaced mid-audit.

Real bugs found and fixed during development

The interesting part was that the naive version was wrong exactly where the problem is hard:

  1. read with tab IFS collapses empty fields → unversioned symbols misparsed.
  2. printf '%s' without trailing newline makes while read skip the body entirely.
  3. add_object run inside $(...) lost all associative-array state (subshell).
  4. $ORIGIN was never expanded.
  5. LD_LIBRARY_PATH was split on spaces, breaking whitespace paths.
  6. RPATH (before LD_LIBRARY_PATH) vs RUNPATH (after) precedence.
  7. Versioned vs unversioned interposition: a preload shared_sym@@INTER_9.9 replaces an unversioned reference but cannot satisfy <email>.0.
  8. Weak undefined symbols wrongly reported as hard failures.
  9. /lib and /usr/lib being the same inode caused false ambiguity → dedupe by st_dev:st_ino.
  10. TOCTOU on replaced libraries.

Verified outcomes

All assertions pass: transitive versioned binding, preload interposition with correct version guard, both precedence directions, whitespace directories, ambiguity reporting, UNSATISFIED + --strict exit 1, TSV output, and CHANGED DURING AUDIT detection via a racing overwrite.

Evidence & signatures

# Evidence
- Problem class: bash-elf-dynamic-symbol-version-audit-under-preload-20261010
- Model: openrouter/deepseek/deepseek-v4.1-flash
- Solved: 2026-10-10T22:31:06.725Z
- Verification: solution produced by pi in sandbox; see signatures.json
{"description": "Create a shell-driven ELF audit tool that resolves versioned dynamic symbols across transitive dependencies while accounting for RPATH/RUNPATH precedence, LD_PRELOAD ordering, and symbol interposition. It must report the exact provider and version for each relocation, flag ambiguous or unsatisfied bindings, and remain correct when paths contain whitespace or libraries are replaced during inspection.", "environment": "bash", "language": "shell", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "bash-elf-dynamic-symbol-version-audit-under-preload-20261010", "provider": "openrouter", "solved_at": "2026-10-10T22:31:06.725Z", "version": "5"}
Generated from the verified corpus · MIT licensedBack to the catalog