Execsnoop misses libclang-cpp.so.14

Ask Fedora
1

Not sure if its a bug, or where to report it. But after installing bcc-tools …

  1. /usr/share/bcc/tools/execsnoop was not added to $PATH
  2. When running /usr/share/bcc/tools/execsnoop, I got:
Traceback (most recent call last):
  File "/usr/share/bcc/tools/execsnoop", line 21, in <module>
    from bcc import BPF
  File "/usr/lib/python3.11/site-packages/bcc/__init__.py", line 26, in <module>
    from .libbcc import lib, bcc_symbol, bcc_symbol_option, bcc_stacktrace_build_id, _SYM_CB_TYPE
  File "/usr/lib/python3.11/site-packages/bcc/libbcc.py", line 17, in <module>
    lib = ct.CDLL("libbcc.so.0", use_errno=True)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.11/ctypes/__init__.py", line 376, in __init__
    self._handle = _dlopen(self._name, mode)
                   ^^^^^^^^^^^^^^^^^^^^^^^^^
OSError: libclang-cpp.so.14: cannot open shared object file: No such file or directory

Thank you a lot for any help!

2

On fedora 36 I have to execute that particular command as root or I have to use options to tell it to only monitor my user processes.

Remember that 37 is still in beta and problems should be identified to the development team.

3

If it’s a binary that users are expected to execute, it probably shouldn’t live in /usr/share/ in the first place. It should live in /usr/bin and so on as per the FHS:

https://www.pathname.com/fhs/pub/fhs-2.3.html

Do you have libclang-cpp.so.14 on your system? It’s provided by the clang-libs package. bcc-tools depends on bcc which does depend on clang-libs, so this file should be available on your system:

$ sudo dnf --release=37 whatprovides '*/libclang-cpp.so.14'
[sudo] password for asinha: 
Last metadata expiration check: 1:13:03 ago on Mon 17 Oct 2022 09:16:35 BST.
clang-libs-14.0.5-1.fc36.x86_64 : Runtime library for clang
Repo        : @System
Matched from:
Filename    : /usr/lib64/libclang-cpp.so.14

clang-libs-14.0.5-6.fc37.i686 : Runtime library for clang
Repo        : fedora
Matched from:
Filename    : /usr/lib/libclang-cpp.so.14

clang-libs-14.0.5-6.fc37.x86_64 : Runtime library for clang
Repo        : fedora
Matched from:
Filename    : /usr/lib64/libclang-cpp.so.14

These are both issues that should be reported to the maintainers:

https://bugzilla.redhat.com/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&component=bcc&list_id=12969998&product=Fedora&query_format=advanced

4

You are getting some outdated information due to file renames. The version of clang in F37 is 15, and the 14 version of the libraries is provided by clang14-libs, but they are no longer in /usr/lib{,64}.

But in any case, this is still a bug in bcc, which needs to look for v15 now.

1 Like