深入分析静态链接时产生的警告：warning: Using 'getpwuid' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking

一、测试环境

运行环境：server: arm64 linux-4.14（开发板）

　　　　　host: x86_64 ubuntu-20.04（主机）

glic 版本：2.30

 

二、流程分析：

接上篇的疑问继续，前提条件，笔者的运行环境中没有包含任何 libnss 库，

测试程序如下：

#include <sys/types.h>
#include <stdio.h>
#include <pwd.h>

int main()
{
    struct passwd *info = NULL;

    info = getpwuid(getuid());
    //printf("Name: %s\n", info->pw_name);
    puts("exec finished.");

    return 0;
}

交叉静态编译传到开发板运行： aarch64-linux-gnu-gcc -static -g -o getname test.c 

用 strace 跟踪了下得到以下的结果：

/ # /mnt/usr/bin/strace ./getname
execve("./getname", ["./getname"], [/* 7 vars */]) = 0
uname({sysname="Linux", nodename="(none)", ...}) = 0
brk(NULL)                               = 0x301fc000
brk(0x301fcf60)                         = 0x301fcf60
readlinkat(AT_FDCWD, "/proc/self/exe", "/getname", 4096) = 8
brk(0x3021df60)                         = 0x3021df60
brk(0x3021e000)                         = 0x3021e000
getuid()                                = 0
socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3
connect(3, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
close(3)                                = 0
socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3
connect(3, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
close(3)                                = 0
openat(AT_FDCWD, "/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/tls//libnss_compat.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
newfstatat(AT_FDCWD, "/lib/tls/", 0xffffc56ce720, 0) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/tls/libnss_compat.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
newfstatat(AT_FDCWD, "/lib/tls", 0xffffc56ce720, 0) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib//libnss_compat.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
newfstatat(AT_FDCWD, "/lib/", {st_mode=S_IFDIR|0755, st_size=4096, ...}, 0) = 0
openat(AT_FDCWD, "/lib/libnss_compat.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
newfstatat(AT_FDCWD, "/lib", {st_mode=S_IFDIR|0755, st_size=4096, ...}, 0) = 0
openat(AT_FDCWD, "/usr/lib/tls//libnss_compat.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
newfstatat(AT_FDCWD, "/usr/lib/tls/", 0xffffc56ce720, 0) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib/tls/libnss_compat.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
newfstatat(AT_FDCWD, "/usr/lib/tls", 0xffffc56ce720, 0) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib//libnss_compat.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
newfstatat(AT_FDCWD, "/usr/lib/", {st_mode=S_IFDIR|0755, st_size=4096, ...}, 0) = 0
openat(AT_FDCWD, "/usr/lib/libnss_compat.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
newfstatat(AT_FDCWD, "/usr/lib", {st_mode=S_IFDIR|0755, st_size=4096, ...}, 0) = 0
openat(AT_FDCWD, "/lib//libnss_files.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib//libnss_files.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
fstat(1, {st_mode=S_IFCHR|0660, st_rdev=makedev(5, 1), ...}) = 0
ioctl(1, TCGETS, {B115200 opost isig icanon echo ...}) = 0
write(1, "exec finished.\n", 15exec finished.
)        = 15
exit_group(0)                           = ?
+++ exited with 0 +++

足以说明，即使是静态链接，但程序也是会用到相关动态库的，虽然进程没有找到 libnss_xxx 库，但也并没有导致它崩溃掉。

要想搞清楚它是怎么引用的动态库，就必须追根溯源深入底层，那就来分析一下 glibc 吧，探下究竟。

下面就是函数的调用过程依次记录下来，简单的流程不加文字简介：

【 getpwuid.c 】

#define LOOKUP_TYPE    struct passwd
#define FUNCTION_NAME    getpwuid
#define DATABASE_NAME    passwd
#define ADD_PARAMS    uid_t uid
#define ADD_VARIABLES    uid
#define BUFLEN        NSS_BUFLEN_PASSWD

#include "../nss/getXXbyYY.c"

【 getXXbyYY.c 】

#define REENTRANT_NAME APPEND_R (FUNCTION_NAME)
#define APPEND_R(name) APPEND_R1 (name)
#define APPEND_R1(name) name##_r

LOOKUP_TYPE *
FUNCTION_NAME (ADD_PARAMS)
{
    ...
    INTERNAL (REENTRANT_NAME) (ADD_VARIABLES, &resbuf, buffer,
                    buffer_size, &result H_ERRNO_VAR)
    ...        
}

在这个文件的最下方有个 nss_interface_function (FUNCTION_NAME) 吸引了我们的注意，进去看看它是做什么的，有什么作用，

嚯，原来竟是它！没有它我们也不会查的这么深入，害人不浅啊。

/* Warning for linking functions calling dlopen into static binaries.  */
#ifdef SHARED
#define static_link_warning(name)
#else
#define static_link_warning(name) static_link_warning1(name)
#define static_link_warning1(name) \
  link_warning(name, "Using '" #name "' in statically linked applications \
requires at runtime the shared libraries from the glibc version used \
for linking")
#endif

猜想是这个 msg 会被放入指定的 section 内，编译或链接时会将它显示出来，先不管它我们继续分析流程，

【 getXXbyYY_r.c 】

int INTERNAL (REENTRANT_NAME) (ADD_PARAMS, LOOKUP_TYPE *resbuf, char *buffer,
               size_t buflen, LOOKUP_TYPE **result H_ERRNO_PARM
               EXTRA_PARAMS)
{
    ...
    DB_LOOKUP_FCT (&nip, REENTRANT_NAME_STRING,
          REENTRANT2_NAME_STRING, &fct.ptr);
    ...
    DL_CALL_FCT (fct.l, (ADD_VARIABLES, resbuf, buffer, buflen,
          &errno H_ERRNO_VAR EXTRA_VARIABLES));

　　　 ...

}

【 XXX-lookup.c 】

int DB_LOOKUP_FCT (service_user **ni, const char *fct_name, const char *fct2_name,
           void **fctp)
{
  if (DATABASE_NAME_SYMBOL == NULL
      && __nss_database_lookup2 (DATABASE_NAME_STRING, ALTERNATE_NAME_STRING,　　　　/* 解析 /etc/nsswitch.conf 文件，提取其中的 service */
                 DEFAULT_CONFIG, &DATABASE_NAME_SYMBOL) < 0)
    return -1;

  *ni = DATABASE_NAME_SYMBOL;

  return __nss_lookup (ni, fct_name, fct2_name, fctp);　　　　　　　　　　　　　　　　　　/* 凶手！就是它引用了 libnss 相关库 */
}

【 nsswich.c 】

int
__nss_lookup (service_user **ni, const char *fct_name, const char *fct2_name,
          void **fctp)
{
  *fctp = __nss_lookup_function (*ni, fct_name);
  if (*fctp == NULL && fct2_name != NULL)
    *fctp = __nss_lookup_function (*ni, fct2_name);

  while (*fctp == NULL
     && nss_next_action (*ni, NSS_STATUS_UNAVAIL) == NSS_ACTION_CONTINUE
     && (*ni)->next != NULL)
    {
      *ni = (*ni)->next;

      *fctp = __nss_lookup_function (*ni, fct_name);
      if (*fctp == NULL && fct2_name != NULL)
    *fctp = __nss_lookup_function (*ni, fct2_name);
    }

  return *fctp != NULL ? 0 : (*ni)->next == NULL ? 1 : -1;
}

【 nsswich.c 】

static int nss_load_library (service_user *ni)
{
  ...
  if (ni->library->lib_handle == NULL)
    {
      /* Load the shared library.  */
      size_t shlen = (7 + strlen (ni->name) + 3
              + strlen (__nss_shlib_revision) + 1);
      int saved_errno = errno;
      char shlib_name[shlen];

      /* Construct shared object name.  */
      __stpcpy (__stpcpy (__stpcpy (__stpcpy (shlib_name,
                          "libnss_"),
                    ni->name),
              ".so"),
        __nss_shlib_revision);

      ni->library->lib_handle = __libc_dlopen (shlib_name);
    ...
}

void *__nss_lookup_function (service_user *ni, const char *fct_name)
{
    ...
    #if !defined DO_STATIC_NSS || defined SHARED
      /* Load the appropriate library.  */
      if (nss_load_library (ni) != 0)
        /* This only happens when out of memory.  */
        goto remove_from_tree;

      if (ni->library->lib_handle == (void *) -1l)
        /* Library not found => function not found.  */
        result = NULL;
      else
        {
          /* Get the desired function.  */
          size_t namlen = (5 + strlen (ni->name) + 1
                   + strlen (fct_name) + 1);
          char name[namlen];

          /* Construct the function name.  */
          __stpcpy (__stpcpy (__stpcpy (__stpcpy (name, "_nss_"),
                        ni->name),
                  "_"),
            fct_name);

          /* Look up the symbol.  */
          result = __libc_dlsym (ni->library->lib_handle, name);
        }
　　#else
      /* We can't get function address dynamically in static linking. */
      {
　　　　# define DEFINE_ENT(h,nm)                              \
        { #h"_get"#nm"ent_r", _nss_##h##_get##nm##ent_r },              \
        { #h"_end"#nm"ent", _nss_##h##_end##nm##ent },              \
        { #h"_set"#nm"ent", _nss_##h##_set##nm##ent },
　　　　# define DEFINE_GET(h,nm)                              \
        { #h"_get"#nm"_r", _nss_##h##_get##nm##_r },
　　　　# define DEFINE_GETBY(h,nm,ky)                              \
        { #h"_get"#nm"by"#ky"_r", _nss_##h##_get##nm##by##ky##_r },
        static struct fct_tbl { const char *fname; void *fp; } *tp, tbl[] =
          {
　　　　# include "function.def"
        { NULL, NULL }
          };
        size_t namlen = (5 + strlen (ni->name) + 1
                 + strlen (fct_name) + 1);
        char name[namlen];

        /* Construct the function name.  */
        __stpcpy (__stpcpy (__stpcpy (name, ni->name),
                "_"),
              fct_name);

        result = NULL;
        for (tp = &tbl[0]; tp->fname; tp++)
          if (strcmp (tp->fname, name) == 0)
        {
          result = tp->fp;
          break;
        }
      }
　　#endif

      /* Remember function pointer for later calls.  Even if null, we
         record it so a second try needn't search the library again.  */
      known->fct_ptr = result;
　　#ifdef PTR_MANGLE
      PTR_MANGLE (known->fct_ptr);
　　#endif
    }
    ...
}

上面那个宏定义就是决定是否已经是静态链接过了 libnss 库，是或不是会走到两个流程，笔者找到一个消除警告的解决办法，应该是重新编译了 glibc，搞出来一个静态的 libnss，正如笔者找到的相关回复所说：

 I get the same warning and to fix it I recompiled glibc. Turn on switch --enable-static-nss when configuring to get it to work. (version >= 2.20) 

请注意源码中的字符串拼接操作，通过拼接找到指定的动态库，也通过拼接进而找到指定的函数符号。

通过拼接所得到的函数名应该为：_nss_files_getpwuid_r，那么该函数是在哪里定义的，我们继续探索发现了 DB_LOOKUP 定义的一个相关结构，

【 files-pwd.c 】

DB_LOOKUP (pwuid, '=', 20, ("%lu", (unsigned long int) uid),
       {
         if (result->pw_uid == uid && result->pw_name[0] != '+'
         && result->pw_name[0] != '-')
           break;
       }, uid_t uid)

那么 DB_LOOKUP 是在哪里定义的，通过搜索找了这里，它就是我们要找的 _nss_files_getpwuid_r，这时我们可以得知，无论是动态链接还是静态链接，调用 getpwuid 后最终走到的函数就是这里没错了：

【 files-XXX.c 】

#define DB_LOOKUP(name, db_char, keysize, keypattern, break_if_match, proto...)\
enum nss_status                                      \
_nss_files_get##name##_r (proto,                          \
              struct STRUCTURE *result, char *buffer,          \
              size_t buflen, int *errnop H_ERRNO_PROTO)          \
{                                          \
  enum nss_status status;                              \
  FILE *stream = NULL;                                  \
                                          \
  /* Open file.  */                                  \
  status = internal_setent (&stream);                          \
                                          \
  if (status == NSS_STATUS_SUCCESS)                          \
    {                                          \
      while ((status = internal_getent (stream, result, buffer, buflen, errnop \
                    H_ERRNO_ARG EXTRA_ARGS_VALUE))          \
         == NSS_STATUS_SUCCESS)                          \
    { break_if_match }                              \
                                          \
      internal_endent (&stream);                          \
    }                                          \
                                          \
  return status;                                  \
}

核心函数的大致流程就是打开 /etc/passwd 文件，解析文件内容得到登录用户名、ID 之类的信息，没有详细看不是本文的目的，最终关掉文件句柄。

 

三、分析总结

哇，终于简单的分析完了调用流程，说实话 glibc 属实不太好分析，宏太多，但不得承认人家写的牛B。

文末扣题，在调用 libnss 中实现的相关 api 时，实时你的 nss 库是动态链接的，那么无论你是可执行程序是想是静态链接还是动态链接，你的运行环境中都要去包含 nss 动态库；

否则你需要在编译 glibc 时 enable static nss 实现 nss 库的静态链接，这样的话，可执行程序就可以实现完全静态了，以达到在任何环境中无依赖运行的目的！