fix: skip /tmp extraction when profiling libraries are installed by r1viollet · Pull Request #529 · DataDog/ddprof

r1viollet · 2026-03-30T11:28:37Z

What does this PR do?

When ddprof is installed as a package, skip writing executables and shared libraries to /tmp. Security scanners like CrowdStrike Falcon flag new executables in /tmp, and the extraction is pointless when
the files already sit in standard system paths.

The loader constructor tries dlopen with the bare library name before falling back to /tmp extraction. After a successful bare-name dlopen, it verifies the loaded library's build version matches via a
new ddprof_profiling_version() symbol to prevent version mismatches between a stale system install and the injected library.

Version macros (VER_MAJ/MIN/PATCH/REV) are now propagated to all profiling library targets so the version string is consistent across the loader, embedded lib, and shared lib.

Two bugs affecting Alpine Linux (musl) are also fixed:

ensure_loader_symbols_promoted() failed on musl. The loader re-opens itself with RTLD_NOLOAD | RTLD_GLOBAL to promote ddprof_lib_state (initial-exec TLS) to global scope before loading the embedded .so.
On musl, RTLD_NOLOAD with a bare SONAME always fails because musl tracks loaded libraries by full path, not SONAME. Fixed by using dladdr() to obtain the loader's actual on-disk path at runtime.

ddprof binary not found when using an installed libdd_profiling-embedded.so. The standalone embedded lib does not contain the ddprof binary (profiler_exe_data() returns size=0), so the previous fallback
left DD_PROFILING_NATIVE_DDPROF_EXE unset. The loader now searches for ddprof relative to its own path: <loader_dir>/../bin/ddprof (package install layout) and <loader_dir>/ddprof (flat build layout),
falling back to extraction from the loader's own embedded data.

The loader() constructor is refactored into three helpers (try_load_installed_profiling_lib, setup_ddprof_exe_for_installed_lib, load_embedded_profiling_lib) and a new test (loader_installed_lib-ut.sh)
covers both path layouts.

Motivation

fix for the following issue

Additional Notes

This now requires the library + the executable to be installed
exe should be:

in same directory ./
in ../bin/

How to test the change?

Describe here in detail how the change can be validated. This is a great section to call out specific tests you've added or improved, or to acknowledge code sections which are particularly difficult to test.

nsavoire · 2026-03-30T12:54:45Z

exec_ddprof gains a similar PATH fallback (execvp), scoped to only fire when no explicit exe path was set, avoiding version mismatches between the extracted .so and a different ddprof binary found in PATH.

I don't see this part ?

r1viollet · 2026-03-30T12:55:12Z

exec_ddprof gains a similar PATH fallback (execvp), scoped to only fire when no explicit exe path was set, avoiding version mismatches between the extracted .so and a different ddprof binary found in PATH.

I don't see this part ?

sorry, I removed that part, I am not sure we want this

r1viollet · 2026-03-30T12:56:38Z

Setting as draft until I get time to get back to this and fix some of the comments from Nicolas.

When ddprof is installed as a package, skip writing executables and shared libraries to /tmp. Security scanners like CrowdStrike Falcon flag new executables in /tmp, and the extraction is pointless when the files already sit in standard system paths. The loader constructor tries dlopen with the bare library name before falling back to /tmp extraction. After a successful bare-name dlopen, it verifies the loaded library's build version matches via a new ddprof_profiling_version() symbol to prevent version mismatches between a stale system install and the injected library. Version macros (VER_MAJ/MIN/PATCH/REV) are now propagated to all profiling library targets so the version string is consistent across the loader, embedded lib, and shared lib. Based on original work by Xavier Roche <[email protected]>. Co-Authored-By: Xavier Roche <[email protected]> Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

…alled lib Split the monolithic loader() constructor into three focused helpers: - try_load_installed_profiling_lib(): silent dlopen + version check - setup_ddprof_exe_for_installed_lib(): find ddprof via relative paths - load_embedded_profiling_lib(): extract lib+exe to /tmp Fix ensure_loader_symbols_promoted() to use dladdr() for the RTLD_NOLOAD call so it works on musl (which tracks libs by full path, not SONAME). Fix exe discovery when using an installed libdd_profiling-embedded.so: the standalone lib does not embed the ddprof binary, so the loader now searches for it relative to its own path: 1. <loader_dir>/../bin/ddprof (standard install layout) 2. <loader_dir>/ddprof (flat build/dev layout) with a fallback to extracting from the loader's own embedded data. Add loader_installed_lib-ut.sh to test both layout cases. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

r1viollet · 2026-03-31T16:59:12Z

this would require a documentation update once we merge

dladdr lives in libdl.so. Like dlopen/dlsym, it may be absent when the loader is dlopen'd into a process that has not yet loaded libdl (e.g. Ubuntu 16 minimal environments), causing an "undefined symbol: dladdr" crash at load time. Add a weak declaration and NULL-guard every call site. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

This speeds up the install test (avoiding a copy of a large ddprof exe)

Adjust following comments from Nicolas in PR #529

This can be the case on old libc versions

nsavoire · 2026-04-02T09:02:38Z

+//   non-NULL handle  — installed library found and version matches
+//   NULL             — library not found or version mismatch (fell back OK)
+//   (void *)-1       — version mismatch but dlclose failed; caller must abort
+static void *try_load_installed_profiling_lib() {


After putting some more thoughts, I think that the strategy "dlopen lib, check version, dlclose if mismatch" is dangerous:
in LD_PRELOAD mode, dlopen will trigger start of dpprof and memory allocation profiling, I am not sure just dlclos'ing the lib is enough. I fear some stale state might be left.

Remove all dlclose usage from the loader constructor — it is unsafe this early and hard to ensure proper cleanup. On version mismatch, warn but proceed with the installed library. Restructure the loader flow to check for the ddprof executable (relative to the loader's path) before attempting to dlopen the installed libdd_profiling-embedded.so. This avoids loading a library we cannot safely unload if the exe turns out to be missing. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

r1viollet · 2026-04-02T13:40:20Z

thanks for adjusting! So simple warning for now, no dlclose 👍

r1viollet · 2026-04-02T13:40:59Z

/merge

gh-worker-devflow-routing-ef8351 · 2026-04-02T13:41:03Z

View all feedbacks in Devflow UI.

2026-04-02 13:41:03 UTC ℹ️ Start processing command /merge

2026-04-02 13:41:08 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in main is approximately 18m (p90).

2026-04-02 13:57:23 UTC ℹ️ MergeQueue: This merge request was merged

r1viollet marked this pull request as ready for review March 30, 2026 11:30

r1viollet requested a review from nsavoire as a code owner March 30, 2026 11:30

nsavoire reviewed Mar 30, 2026

View reviewed changes

Comment thread src/lib/loader.c Outdated

nsavoire reviewed Mar 30, 2026

View reviewed changes

Comment thread src/lib/loader.c Outdated

nsavoire reviewed Mar 30, 2026

View reviewed changes

Comment thread src/lib/dd_profiling.cc Outdated

r1viollet marked this pull request as draft March 30, 2026 12:56

nsavoire reviewed Mar 30, 2026

View reviewed changes

Comment thread src/lib/loader.c Outdated

Comment thread src/lib/dd_profiling.cc Outdated

Comment thread test/version_mismatch-ut.sh

r1viollet force-pushed the r1viollet/fix-tmp-extraction branch from 26099e7 to a95cde6 Compare March 31, 2026 13:40

r1viollet and others added 2 commits March 31, 2026 16:59

minor loader fix: Add an error if dlclose is not available

ec3b335

r1viollet marked this pull request as ready for review March 31, 2026 16:58

r1viollet commented Apr 1, 2026

View reviewed changes

Comment thread test/CMakeLists.txt

r1viollet and others added 2 commits April 1, 2026 09:35

minor test update: replace ddprof with a stub

da56963

This speeds up the install test (avoiding a copy of a large ddprof exe)

r1viollet assigned nsavoire Apr 1, 2026

r1viollet mentioned this pull request Apr 1, 2026

fix: skip /tmp extraction when profiling libraries are installed #526

Closed

nsavoire reviewed Apr 1, 2026

View reviewed changes

Comment thread src/lib/loader.c Outdated

nsavoire reviewed Apr 1, 2026

View reviewed changes

Comment thread src/lib/loader.c

nsavoire reviewed Apr 1, 2026

View reviewed changes

Comment thread src/lib/loader.c Outdated

nsavoire reviewed Apr 1, 2026

View reviewed changes

Comment thread src/lib/loader.c Outdated

loader minor refoctor

4d4e3c4

Adjust following comments from Nicolas in PR #529

nsavoire reviewed Apr 1, 2026

View reviewed changes

Comment thread src/lib/loader.c Outdated

fix loader behaviour: dlclose on install exe failure

20fd4c5

r1viollet requested a review from nsavoire April 1, 2026 10:35

nsavoire reviewed Apr 1, 2026

View reviewed changes

Comment thread src/lib/loader.c Outdated

loader: handle cases where dladdr & dlclose or not available

cb175a2

This can be the case on old libc versions

r1viollet requested a review from nsavoire April 1, 2026 15:10

nsavoire reviewed Apr 2, 2026

View reviewed changes

nsavoire force-pushed the r1viollet/fix-tmp-extraction branch from 68ebfa2 to 6282c69 Compare April 2, 2026 13:10

nsavoire approved these changes Apr 2, 2026

View reviewed changes

gh-worker-dd-devflow-36fce6 Bot added mergequeue-status: queued mergequeue-status: in_progress and removed mergequeue-status: queued labels Apr 2, 2026

gh-worker-dd-mergequeue-cf854d Bot merged commit 90b41db into main Apr 2, 2026
4 checks passed

gh-worker-dd-devflow-36fce6 Bot removed the mergequeue-status: in_progress label Apr 2, 2026

gh-worker-dd-mergequeue-cf854d Bot deleted the r1viollet/fix-tmp-extraction branch April 2, 2026 13:57

gh-worker-dd-devflow-36fce6 Bot added the mergequeue-status: done label Apr 2, 2026

Uh oh!

Conversation

r1viollet commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Motivation

Additional Notes

How to test the change?

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nsavoire commented Mar 30, 2026

Uh oh!

r1viollet commented Mar 30, 2026

Uh oh!

r1viollet commented Mar 30, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

r1viollet commented Mar 31, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nsavoire Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

r1viollet commented Apr 2, 2026

Uh oh!

r1viollet commented Apr 2, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 Bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

r1viollet commented Mar 30, 2026 •

edited

Loading

gh-worker-devflow-routing-ef8351 Bot commented Apr 2, 2026 •

edited

Loading