ELF file format find shared object for symbol

Question

(in Windows) PE file format contains Import table with Module\Dll Name which tells PE loader where to search for symbol e.g. KERNEL32.dll -> CreateFileW

In the ELF file format there is Symbol table with info field which tells if the symbol is Global\Local\Weak\etc.

My question is how does the Unix loader know what is the module, shared object where to search for this symbol e.g. ???? -> snprintf

I noticed objdump can dump this info objdump -T /bin/ls. GLIBC_2.2.5 snprintf

Could someone with more knowledge on ELF file format shed some light on Unix dynamic-linking?

Answer 1

how does the Unix loader know what is the module, shared object where to search for this symbol

Short answer: it does not. It just searches the whole list of loaded modules until the symbol is found (or not). A small degree of control over more exact symbol matching can be achieved via versioned symbols but otherwise it's pretty much a free-for-all.

By design, the ELF symbol space is global (or flat) so any symbol can be preempted by another module. This is used for example when hooking symbols via LD_PRELOAD_LIBRARY environment variable.