linuxsystemloaderlockout

How to safely replace /lib/x86_64-linux-gnu/ld-X.Y.so?


I'm rebuilding my distro's official eglibc package with an additional tweak that should only affect its ld.so (installed as /lib/x86_64-linux-gnu/ld-X.Y.so) as far as I can tell.

I know I can invoke the new version of this helper/loader tool directly from the build directory to test it (but does that really mean the installed version doesn't get used at all?!) but is it possible to replace the installed copy manually and if so, how do I do that safely, without risk of getting locked out and having to boot off a different drive/partition to restore things?

I see no reason that would make it impossible to make a backup of the original version (e.g. sudo cp -p /lib/x86_64-linux-gnu/ld-X.Y.so{,-org}) but can I be certain that I can do the reverse operation if ever the new version doesn't work?

I see /path/to/eglibc/build-tree/amd64-libc/elf/ld.so /usr/bin/sudo ... fails with sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges? so that appears not to be an option (EDIT) to restore the ld-X.Y.so.org backup.


FWIW, the tweak in question is just a bump to DTV_SURPLUS so I can hopefully update Mesa without running into pesky "no more static TLS" load failures.


Solution

  • how do I do that safely, without risk of getting locked out and having to boot off a different drive/partition to restore things?

    Simulate a filesystem and test on it. Use virtualization, containers, docker or podman, chroot, user namespaces with unshare, proot or bwrap.

    For example on my host system I have:

    $ /lib/ld-linux.so.2 --version
    ld.so (GNU libc) stable release version 2.34.
    

    I can temporary replace ld-linux.so.2 using proot from nix glibc installed into /nix:

    $ proot -b /nix/store/cg9s562sa33k78m63njfn1rw47dp9z0i-glibc-2.40-66/lib/ld-linux-x86-64.so.2:/lib/ld-linux.so.2 bash
    bash-5.1$ /lib/ld-linux.so.2 --version
    ld.so (GNU libc) stable release version 2.40.
    

    You could easily test with docker or podman by overmounting container ld.so with your ld.so, like docker run -ti --rm -v ./your/ld:/lib/ld-linux.so.2 ubuntu bash -c 'etc...'.