fix(build): enable lazy binding to resolve symbol lookup errors #1350
Conversation
There was a problem hiding this comment.
Pull request overview
This PR adds a lazy binding linker flag to the CGO-enabled Linux AMD64 build configuration to resolve symbol lookup errors during the build process.
Key Changes
- Added
-extldflags "-Wl,-z,lazy"to thelinux-amd64-cgobuild configuration's ldflags to enable lazy symbol binding
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| ldflags: | ||
| - -s -w | ||
| - -X flashcat.cloud/categraf/config.Version={{ .Tag }}-{{.Commit}} | ||
| - -extldflags "-Wl,-z,lazy" |
There was a problem hiding this comment.
Using -Wl,-z,lazy enables lazy symbol binding, which defers symbol resolution until functions are called. While this may resolve build-time symbol lookup errors, it has security implications:
-
Security concern: Lazy binding is vulnerable to GOT (Global Offset Table) hijacking attacks. Modern security best practices recommend using
-Wl,-z,now(immediate binding) instead, which is often combined with RELRO (read-only relocations) for hardening. -
Trade-off: Lazy binding provides faster startup time but weaker security, while immediate binding (
-z,now) provides better security at the cost of slightly slower startup.
If symbol lookup errors are occurring, consider investigating the root cause rather than using lazy binding. Common solutions include:
- Ensuring all required libraries are properly linked
- Verifying library paths and dependencies
- Using
-Wl,--no-as-neededif symbols are being incorrectly stripped
If lazy binding is intentionally required for this CGO build, consider documenting the rationale and security trade-off.
| - -extldflags "-Wl,-z,lazy" | |
| - -extldflags "-Wl,-z,now" |
1 participant
No description provided.