--- name: "rtld" section: "1" platform: "freebsd" package: "base" version: "16.0-CURRENT-20261027-61c70dc16a79" release: "FreeBSD 16.0-CURRENT (2026-10-27)" platforms: ["freebsd"] url: "https://new.carta.tech/ld-elf.so.1" --- # rtld(1) run-time link-editor Part of [ld-elf.so.1(1)](/ld-elf.so.1/1.md). ## NAME **ld-elf.so.1**, **ld.so**, **rtld** – run-time link-editor ## DESCRIPTION The **ld-elf.so.1** utility is a self-contained shared object providing run-time support for loading and link-editing shared objects into a process' address space. It is also commonly known as the dynamic linker. It uses the data structures contained within dynamically linked programs to determine which shared libraries are needed and loads them using the [mmap(2)](/mmap/2.md) system call. After all shared libraries have been successfully loaded, **ld-elf.so.1** proceeds to resolve external references from both the main program and all objects loaded. A mechanism is provided for initialization routines to be called on a per-object basis, giving a shared object an opportunity to perform any extra set-up before execution of the program proper begins. This is useful for C++ libraries that contain static constructors. When resolving dependencies for the loaded objects, **ld-elf.so.1** translates dynamic token strings in rpath and soname. If the **-z origin** option of the static linker was set when linking the binary, the token expansion is performed at the object load time, see [ld(1)](/ld/1.md). The following strings are recognized now: - *$ORIGIN* Translated to the full path of the loaded object. - *$OSNAME* Translated to the name of the operating system implementation. - *$OSREL* Translated to the release level of the operating system. - *$PLATFORM* Translated to the machine hardware platform. - *$LIB* Translated to the system library path component on the platform. It is *lib* for native binaries, and typically *lib32* for compat32 binaries. Other translations might exist for other ABIs supported on the platform. The **ld-elf.so.1** utility itself is loaded by the kernel together with any dynamically-linked program that is to be executed. The kernel transfers control to the dynamic linker. After the dynamic linker has finished loading, relocating, and initializing the program and its required shared objects, it transfers control to the entry point of the program. The following search order is used to locate required shared objects: 1. DT\_RPATH of the referencing object unless that object also contains a DT\_RUNPATH tag 2. DT\_RPATH of the program unless the referencing object contains a DT\_RUNPATH tag 3. Path indicated by LD\_LIBRARY\_PATH environment variable 4. DT\_RUNPATH of the referencing object 5. Hints file produced by the [ldconfig(8)](/ldconfig/8.md) utility 6. The */lib* and */usr/lib* directories, unless the referencing object was linked using the “**-z** *nodefaultlib*” option The **ld-elf.so.1** utility recognizes a number of environment variables that can be used to modify its behaviour. On 64-bit architectures, the linker for 32-bit objects recognizes all the environment variables listed below, but is being prefixed with LD\_32\_, for example: LD\_32\_TRACE\_LOADED\_OBJECTS. If the activated image is setuid or setgid, the variables are ignored. The run-time linker is able to access the environment provided at process startup. After startup, environment variables are maintained by higher-level libraries and are not accessible by the run-time linker. At run-time, effective settings can be queried using [rtld\_get\_var(3)](/rtld_get_var/3.md), and some of them can be changed with [rtld\_set\_var(3)](/rtld_set_var/3.md). - LD\_DUMP\_REL\_POST If set, **ld-elf.so.1** will print a table containing all relocations after symbol binding and relocation. - LD\_DEBUG If set, **ld-elf.so.1** will print voluminous internal debugging messages as it loads and links a program. - LD\_DUMP\_REL\_PRE If set, **ld-elf.so.1** will print a table containing all relocations before symbol binding and relocation. - LD\_DYNAMIC\_WEAK If set, use the ELF standard-compliant symbol lookup behavior: resolve to the first found symbol definition. By default, FreeBSD provides the non-standard symbol lookup behavior: when a weak symbol definition is found, remember the definition and keep searching in the remaining shared objects for a non-weak definition. If found, the non-weak definition is preferred, otherwise the remembered weak definition is returned. Symbols exported by dynamic linker itself (see dlfcn(3)) are always resolved using FreeBSD rules regardless of the presence of the variable. This variable is unset for set-user-ID and set-group-ID programs. - LD\_LIBMAP A library replacement list in the same format as [libmap.conf(5)](/libmap.conf/5.md). For convenience, the characters ‘=’ and ‘,’ can be used instead of a space and a newline. This variable is parsed after [libmap.conf(5)](/libmap.conf/5.md), and will override its entries. This variable is unset for set-user-ID and set-group-ID programs. - LD\_LIBMAP\_DISABLE If set, disables the use of [libmap.conf(5)](/libmap.conf/5.md) and LD\_LIBMAP. This variable is unset for set-user-ID and set-group-ID programs. - LD\_ELF\_HINTS\_PATH This variable will override the default location of “hints” file. This variable is unset for set-user-ID and set-group-ID programs. - LD\_LIBRARY\_PATH A colon separated list of directories, overriding the default search path for shared libraries. This variable is unset for set-user-ID and set-group-ID programs. - LD\_LIBRARY\_PATH\_RPATH If the variable is specified and has a value starting with any of ´y´, ´Y´ or ´1´ symbols, the path specified by LD\_LIBRARY\_PATH variable is allowed to override the path from DT\_RPATH for binaries which does not contain DT\_RUNPATH tag. For such binaries, when the variable LD\_LIBRARY\_PATH\_RPATH is set, “**-z** *nodefaultlib*” link-time option is ignored as well. - LD\_PRELOAD A list of shared libraries, separated by colons and/or white space, to be linked in before any other shared libraries. If the directory is not specified then the directories specified by LD\_LIBRARY\_PATH will be searched first followed by the set of built-in standard directories. This variable is unset for set-user-ID and set-group-ID programs. - LD\_PRELOAD\_FDS A colon separated list of file descriptor numbers for libraries. This is intended for preloading libraries in which we already have a file descriptor. This may optimize the process of loading libraries because we do not have to look for them in directories. It may also be useful in a capability base system where we do not have access to global namespaces such as the filesystem. - LD\_LIBRARY\_PATH\_FDS A colon separated list of file descriptor numbers for library directories. This is intended for use within [capsicum(4)](/capsicum/4.md) sandboxes, when global namespaces such as the filesystem are unavailable. It is consulted just after LD\_LIBRARY\_PATH. This variable is unset for set-user-ID and set-group-ID programs. - LD\_BIND\_NOT When set to a nonempty string, prevents modifications of the PLT slots when doing bindings. As result, each call of the PLT-resolved function is resolved. In combination with debug output, this provides complete account of all bind actions at runtime. This variable is unset for set-user-ID and set-group-ID programs. - LD\_BIND\_NOW When set to a nonempty string, causes **ld-elf.so.1** to relocate all external function calls before starting execution of the program. Normally, function calls are bound lazily, at the first call of each function. LD\_BIND\_NOW increases the start-up time of a program, but it avoids run-time surprises caused by unexpectedly undefined functions. - LD\_TRACE\_LOADED\_OBJECTS When set to a nonempty string, causes **ld-elf.so.1** to exit after loading the shared objects and printing a summary which includes the absolute pathnames of all objects, to standard output. - LD\_TRACE\_LOADED\_OBJECTS\_ALL When set to a nonempty string, causes **ld-elf.so.1** to expand the summary to indicate which objects caused each object to be loaded. - LD\_TRACE\_LOADED\_OBJECTS\_FMT1 - LD\_TRACE\_LOADED\_OBJECTS\_FMT2 When set, these variables are interpreted as format strings a la [printf(3)](/printf/3.md) to customize the trace output and are used by [ldd(1)](/ldd/1.md)'s **-f** option and allows [ldd(1)](/ldd/1.md) to be operated as a filter more conveniently. If the dependency name starts with string *lib*, LD\_TRACE\_LOADED\_OBJECTS\_FMT1 is used, otherwise LD\_TRACE\_LOADED\_OBJECTS\_FMT2 is used. The following conversions can be used: - %a The main program's name (also known as “\_\_progname”). - %A The value of the environment variable LD\_TRACE\_LOADED\_OBJECTS\_PROGNAME. Typically used to print both the names of programs and shared libraries being inspected using [ldd(1)](/ldd/1.md). - %o The library name. - %p The full pathname as determined by **rtld**'s library search rules. - %x The library's load address. Additionally, ‘\\n’ and ‘\\t’ are recognized and have their usual meaning. - LD\_UTRACE If set, **ld-elf.so.1** will log events such as the loading and unloading of shared objects via [utrace(2)](/utrace/2.md). - LD\_LOADFLTR If set, **ld-elf.so.1** will process the filtee dependencies of the loaded objects immediately, instead of postponing it until required. Normally, the filtees are opened at the time of the first symbol resolution from the filter object. - LD\_SHOW\_AUXV If set, causes **ld-elf.so.1** to dump content of the aux vector to standard output, before passing control to any user code. - LD\_STATIC\_TLS\_EXTRA If the variable is specified and has a numeric value, **ld-elf.so.1** will set the size of the static TLS extra space to the specified number of bytes. The static TLS extra space is used when loading objects compiled for initial-exec TLS code model with [dlopen(3)](/dlopen/3.md). The minimum value that can be specified is ´128´. - LD\_NO\_DL\_ITERATE\_PHDR\_AFTER\_FORK Allow [dl\_iterate\_phdr(3)](/dl_iterate_phdr/3.md) to block in callback, without causing deadlock with the [fork(2)](/fork/2.md). The drawback is that the image started in this mode cannot use [dl\_iterate\_phdr(3)](/dl_iterate_phdr/3.md) after fork. ## DIRECT EXECUTION MODE **ld-elf.so.1** is typically used implicitly, loaded by the kernel as requested by the PT\_INTERP program header of the executed binary. FreeBSD also supports a direct execution mode for the dynamic linker. In this mode, the user explicitly executes **ld-elf.so.1** and provides the path of the program to be linked and executed as an argument. This mode allows use of a non-standard dynamic linker for a program activation without changing the binary or without changing the installed dynamic linker. Execution options may be specified. The syntax of the direct invocation is */libexec/ld-elf.so.1* \[**-b** *exe*\] \[**-d**\] \[**-f** *fd*\] \[**-o** *OPT=VALUE*\] \[**-p**\] \[**-u**\] \[**-v**\] \[**--**\] *image\_path* \[*image* *arguments*\] The options are: - **-b** *exe* Use the executable *exe* instead of *image\_path* for activation. If this option is specified, *image\_path* is only used to provide the *argv\[0\]* value to the program. - **-d** Turn off the emulation of the binary execute permission. - **-f** *fd* File descriptor *fd* references the binary to be activated by **ld-elf.so.1**. It must already be opened in the process when executing **ld-elf.so.1**. If this option is specified, *image\_path* is only used to provide the *argv\[0\]* value to the program. - **-o** *OPT=VALUE* Set the *OPT* configuration variable to the value *VALUE*. The possible variable names are listed above as LD\_ prefixed environment variables, but here are referenced without the LD\_ prefix. A configuration variable set this way does not leak into the activated image's environment. The option can be repeated as many times as needed to set all configuration parameters. The parameters set using this option have priority over the same parameters assigned via environment. - **-p** If the *image\_path* argument specifies a name which does not contain a slash “/” character, **ld-elf.so.1** uses the search path provided by the environment variable PATH to find the binary to execute. - **-u** Ignore all LD\_ environment variables and previous command line **-o** options that otherwise affect the dynamic linker behavior. - **-v** Display information about this run-time linker binary, then exit. - **--** Ends the **ld-elf.so.1** options. The argument following **--** is interpreted as the path of the binary to execute. In the direct execution mode, **ld-elf.so.1** emulates verification of the binary execute permission for the current user. This is done to avoid breaking user expectations in naively restricted execution environments. The verification only uses Unix DACs, ignores ACLs, and is naturally prone to race conditions. Environments which rely on such restrictions are weak and breakable on their own. It can be turned off with the **-d** option. ## VERSIONING Newer **ld-elf.so.1** might provide some features or changes in runtime behavior that cannot be easily detected at runtime by checking of the normal exported symbols. Note that it is almost always wrong to verify \_\_FreeBSD\_version in userspace to detect features, either at compile or at run time, because either kernel, or libc, or environment variables could not match the running **ld-elf.so.1**. To solve the problem, **ld-elf.so.1** exports some feature indicators in the FreeBSD private symbols namespace FBSDprivate\_1.0. Symbols start with the \_rtld\_version prefix. Current list of defined symbols and corresponding features is: - \_rtld\_version\_\_FreeBSD\_version Symbol exports the value of the \_\_FreeBSD\_version definition as it was provided during the **ld-elf.so.1** build. The symbol is always present since the \_rtld\_version facility was introduced. - \_rtld\_version\_laddr\_offset The *l\_addr* member of the *link\_map* structure contains the load offset of the shared object. Before that, *l\_addr* contained the base address of the library. See [dlinfo(3)](/dlinfo/3.md). Also it indicates the presence of *l\_refname* member of the structure. - \_rtld\_version\_dlpi\_tls\_data The *dlpi\_tls\_data* member of the structure *dl\_phdr\_info* contains the address of the module TLS segment for the calling thread, and not the address of the initialization segment. ## FILES - */var/run/ld-elf.so.hints* Hints file. - */var/run/ld-elf32.so.hints* Hints file for 32-bit binaries on 64-bit system. - */etc/libmap.conf* The libmap configuration file. - */etc/libmap32.conf* The libmap configuration file for 32-bit binaries on 64-bit system. ## SEE ALSO [ld(1)](/ld/1.md), [ldd(1)](/ldd/1.md), [dlinfo(3)](/dlinfo/3.md), [rtld\_get\_var(3)](/rtld_get_var/3.md), [capsicum(4)](/capsicum/4.md), [elf(5)](/elf/5.md), [libmap.conf(5)](/libmap.conf/5.md), [ldconfig(8)](/ldconfig/8.md)