Bug#525779: [checks/shared-libs] warn about private libraries/plugins in /usr/lib

[Russ Allbery <rra@debian.org>]

Raphael Geissert <atomo64@gmail.com> writes:

> It was basically that; requiring [^_] because some libs incorrectly
> export symbols that should not be exported (i.e. private). The
> assumption is that if no public symbol is exported then it is a
> plugin.

Don't plugins have to export symbols, though?  All PAM modules do, for
instance.  Usually, plugins export symbols the same way as shared
libraries and the loading application calls into specific symbols (or
uses a struct for calling points).

> On my machine it matches /usr/lib/libkaffeine*.so, which should be in
> some place like /usr/lib/kaffeine/

I think you're getting false positives from the fact that all C++
symbols start with _Z due to mangling.  I get hits for that search for
basically everything written in pure C++, including libraries that I
know are supposed to be public.

If I run:

for f in /usr/lib/*.so.* ; do
  nm -D "$f" | egrep -q '^[a-f0-9]+ [^U] ([^_]|_Z)' || echo "$f is private"
done

instead, I get three libraries on my system:

    libGLcore.so.1
    libgmp.so.3
    libnvidia-tls.so.1

libgmp appears to be an artifact of how GMP handles its naming
conventions, GLcore seems to be a weird special case, and
libnvidia-tls.so is just some bizarre proprietary thing but isn't a
plugin.

-- 
Russ Allbery (rra@debian.org)               <http://www.eyrie.org/~eagle/>