chatr can modify the library to be loaded for a binary?

[arking1981]

Dear all,

Can you please tell me if chatr can modify the library to be loaded for a binary? 

For example, I have such a simple binary:

a7server # chatr aa.run

aa.run:

         shared executable

         shared library dynamic path search:

             SHLIB_PATH     disabled  second

             embedded path  disabled  first  Not Defined

         shared library list:

             dynamic   /usr/lib/libsec.2

             dynamic   /usr/lib/libstd.2

             dynamic   /usr/lib/libstream.2

             dynamic   /usr/lib/libCsup.2

             dynamic   /usr/lib/libm.2

             dynamic   /usr/lib/libcl.2

             dynamic   /usr/lib/libc.2

             static    /usr/lib/libdld.2

         shared library binding:

             deferred

         global hash table disabled

         plabel caching disabled

         global hash array size:1103

         global hash array nbuckets:3

         shared vtable support disabled

         explicit unloading enabled

         static branch prediction disabled

         executable from stack: D (default)

         kernel assisted branch prediction enabled

         lazy swap allocation disabled

         text segment locking disabled

         data segment locking disabled

         third quadrant private data space disabled

         fourth quadrant private data space disabled

         third quadrant global data space disabled

         data page size: D (default)

         instruction page size: D (default)

         nulptr references disabled

         shared library private mapping disabled

         shared library text merging disabled

I want it to dynamically load another libc.2(the standard C library), i.e. /tmp/libc.2 (which can in essence be a duplicated one, I just use it for example to understand if chatr has the ability). I know there is something called interposition technique, which can use LD_PRELOAD to let binary load self-defined library first. And interposition is on linux(all articles I read seem to tell me this), is it applicable on HP-UX? 

Here, I am not discussing interposition technique, but quite eager to know if chatr has such a ability. I tried many times but failed. 

Please help and thanks in advance.

Best Regards

Kang

[Dennis Handly]

>I want it to dynamically load another libc.2 (the standard C library)

You can do this with SHLIB_PATH and LD_LIBRARY_PATH (Integrity and PA64 only).

shared library dynamic path search:
             SHLIB_PATH     disabled  second
             embedded path  disabled  first  Not Defined

This has it disabled, the PA32 default.  You can enable it with:  chatr +s enable aa.run

(Or link with -Wl,+s.)

Then you can export SHLIB_PATH to point to your alternate directories.

[arking1981]

(Too long, let me post it in 2 parts)

PART 1:

Thanks Dennis. But can you be a little more detailed? I have tried it but seems not successful.

a7server # pwd

/tmp/xk

a7server # ll aa.run

-rwxr-xr-x   1 root       sys          77824 Sep 15 10:19 aa.run

a7server # chatr aa.run

aa.run:

         shared executable

         shared library dynamic path search:

             SHLIB_PATH     enabled   second  <-- I have enable it using "chatr +s enable aa.run"

             embedded path  disabled  first  Not Defined

         shared library list:

             dynamic   /usr/lib/libsec.2

             dynamic   /usr/lib/libstd.2

             dynamic   /usr/lib/libstream.2

             dynamic   /usr/lib/libCsup.2

             dynamic   /usr/lib/libm.2

             dynamic   /usr/lib/libcl.2

             dynamic   /usr/lib/libc.2

             static    /usr/lib/libdld.2

         shared library binding:

             deferred

         global hash table disabled

         plabel caching disabled

         global hash array size:1103

         global hash array nbuckets:3

         shared vtable support disabled

         explicit unloading enabled

         static branch prediction disabled

         executable from stack: D (default)

         kernel assisted branch prediction enabled

         lazy swap allocation disabled

         text segment locking disabled

         data segment locking disabled

         third quadrant private data space disabled

         fourth quadrant private data space disabled

         third quadrant global data space disabled

         data page size: D (default)

         instruction page size: D (default)

         nulptr references disabled

         shared library private mapping disabled

         shared library text merging disabled

a7server # echo $LD_LIBRARY_PATH

.:/acc7ora/product/10.2.0/lib32:/usr/local/lib <-- I add current path '.' to the path

a7server # echo $SHLIB_PATH

/usr/lib:......:/tmp/xk  <-- also add current path into SHLIB_PATH

a7server # chatr -l /tmp/xk/libc33 aa.run <-- Then I tried to let aa.run link with /tmp/xk/libc33 (a simple copy of libc.2)

aa.run:

   current values:

         shared executable

         shared library dynamic path search:

             SHLIB_PATH     enabled   second

             embedded path  disabled  first  Not Defined

         shared library list:

             dynamic   /usr/lib/libsec.2

             dynamic   /usr/lib/libstd.2

             dynamic   /usr/lib/libstream.2

             dynamic   /usr/lib/libCsup.2

             dynamic   /usr/lib/libm.2

             dynamic   /usr/lib/libcl.2

             dynamic   /usr/lib/libc.2

             static    /usr/lib/libdld.2

         shared library binding:

             deferred

         global hash table disabled

         plabel caching disabled

         global hash array size:1103

         global hash array nbuckets:3

         shared vtable support disabled

         explicit unloading enabled

         static branch prediction disabled

         executable from stack: D (default)

         kernel assisted branch prediction enabled

         lazy swap allocation disabled

         text segment locking disabled

         data segment locking disabled

         third quadrant private data space disabled

         fourth quadrant private data space disabled

         third quadrant global data space disabled

         data page size: D (default)

         instruction page size: D (default)

         nulptr references disabled

         shared library private mapping disabled

         shared library text merging disabled

chatr(error): shared library path not found in the list -- /tmp/xk/libc33 <-- Failed

[arking1981]

Then I tried to use chatr to apply new library in another way

a7server # chatr `chatr aa.run | sed  -n -e '/\/usr\/lib\/libc.2/s/.*\/usr\/lib\/libc.2/-l \/tmp\/xk\/libc33/p'` aa.run

aa.run:

   current values:

         shared executable

         shared library dynamic path search:

             SHLIB_PATH     enabled   second

             embedded path  disabled  first  Not Defined

         shared library list:

             dynamic   /usr/lib/libc.2

             static    /usr/lib/libdld.2

         shared library binding:

             deferred

.....

chatr(error): shared library path not found in the list -- /tmp/xk/libc33

The sed command just give the same command line

a7server # chatr aa.run | sed  -n -e '/\/usr\/lib\/libc.2/s/.*\/usr\/lib\/libc.2/-l \/tmp\/xk\/libc33/p'

-l /tmp/xk/libc33

What I want to achieve is as below:

aa.run:

         shared executable

         shared library dynamic path search:

             SHLIB_PATH     enabled   second

             embedded path  disabled  first  Not Defined

         shared library list:

             dynamic   /tmp/xk/lib33  <-- This is what I wanted to achieve; to replace libc.2 with another copy; and if it is feasible I can replace it with another lib defined by myself

             static    /usr/lib/libdld.2

         shared library binding:

             deferred

......

Is this possible?

From and name chatr, change attribute, it looks possible. Right?

Please suggest

[Dennis Handly · Accepted solution]

>But can you be a little more detailed?

Have you tried "ld +help"?

>         shared library dynamic path search:
>             SHLIB_PATH     enabled   second  <-- I have enable it using "chatr +s enable aa.run"
># echo $LD_LIBRARY_PATH

Not supported for PA32.

># echo $SHLIB_PATH
>/usr/lib:......:/tmp/xk  <-- also add current path into SHLIB_PATH

Ok.  This allows you to look for shlibs in /tmp/xk/, with their original basenames, like libc.2.

># chatr -l /tmp/xk/libc33 aa.run <-- Then I tried to let aa.run link with /tmp/xk/libc33

>chatr(error): shared library path not found in the list -- /tmp/xk/libc33

That's not what -l does (it only turns on and off bits for existing shlibs) .  The copy must have the exact same basename: libc.2

>What I want to achieve is as below:
>             dynamic   /tmp/xk/lib33  <-- This is what I wanted to achieve; to replace libc.2 with another copy

>Is this possible?  From the name chatr, change attribute, it looks possible.

chatr(1) can't change names.  chatr(1) can only change trivially small things like flipping bits in the load module.  Not a complete rewrite for changing search paths.