How to see the currently loaded shared objects in Linux?

Question

I have two, related questions:

• How can I see if a shared library is currently loaded? (i.e. system-wide, process agnostic)
• How can I see all shared libraries loaded by a process?

Answer 1

You can do both with lsof. To see what processes have a library open or mapped do:

lsof /path/to/lib.so

and to see what files (including shared libraries) a process has open and/or mapped, do:

lsof -p <pid>

Answer 2

Another way to see what's loaded in a process is by looking at the /proc/PID/maps file. This shows everything mapped into your address space, including shared objects mapped in.

Answer 3

sudo grep libcairo.so /proc/*/maps

is a nice way to explore all /proc/PID/maps mentioned by Rich at once. Sample output:

/proc/8390/maps:7f0a9afae000-7f0a9b0bc000 r-xp 00000000 fc:00 274690                     /usr/lib/x86_64-linux-gnu/libcairo.so.2.11400.6
/proc/8390/maps:7f0a9b0bc000-7f0a9b2bc000 ---p 0010e000 fc:00 274690                     /usr/lib/x86_64-linux-gnu/libcairo.so.2.11400.6
/proc/8390/maps:7f0a9b2bc000-7f0a9b2bf000 r--p 0010e000 fc:00 274690                     /usr/lib/x86_64-linux-gnu/libcairo.so.2.11400.6
/proc/8390/maps:7f0a9b2bf000-7f0a9b2c0000 rw-p 00111000 fc:00 274690                     /usr/lib/x86_64-linux-gnu/libcairo.so.2.11400.6
/proc/8466/maps:7f0a9afae000-7f0a9b0bc000 r-xp 00000000 fc:00 274690                     /usr/lib/x86_64-linux-gnu/libcairo.so.2.11400.6
/proc/8466/maps:7f0a9b0bc000-7f0a9b2bc000 ---p 0010e000 fc:00 274690                     /usr/lib/x86_64-linux-gnu/libcairo.so.2.11400.6
/proc/8466/maps:7f0a9b2bc000-7f0a9b2bf000 r--p 0010e000 fc:00 274690                     /usr/lib/x86_64-linux-gnu/libcairo.so.2.11400.6
/proc/8466/maps:7f0a9b2bf000-7f0a9b2c0000 rw-p 00111000 fc:00 274690                     /usr/lib/x86_64-linux-gnu/libcairo.so.2.11400.6

Further awk and bash-fu can refine the output further.

This method also shows libraries opened with dlopen, tested with this minimal setup hacked up with a sleep(1000) on Ubuntu 18.04.

Answer 4

You can run the next command by root and see a full list,

cat /proc/*/maps | awk '{print $6;}' | grep '\.so' | sort | uniq

This is for users who don't have lsof.