Stripping linux shared libraries

Optimizing Linux Shared Libraries: A Guide to Stripping Symbols

Learn how to use the strip command to remove debugging and symbol information from Linux shared libraries, reducing file size and improving security.

When developing applications on Linux, shared libraries (.so files) are fundamental for modularity and code reuse. However, by default, these libraries often contain a significant amount of metadata, such as debugging symbols and relocation information. While useful during development, this information can increase file size, potentially impact load times, and even expose internal details of your code in production environments. This article will guide you through the process of 'stripping' these libraries using the strip utility, explaining its benefits and practical application.

What is Stripping and Why Do It?

Stripping a shared library refers to the process of removing unnecessary information from its binary. This typically includes debugging symbols (like function names, variable names, and line numbers) and sometimes relocation information. The primary reasons for stripping libraries are:

• Reduced File Size: Smaller binaries consume less disk space and can lead to faster download and deployment times, especially in embedded systems or network-constrained environments.
• Improved Load Times: While often marginal for individual libraries, a cumulative reduction in binary size can contribute to faster application startup.
• Enhanced Security: Removing debugging symbols makes reverse-engineering your code more challenging, as internal function names and structure are obscured. This doesn't make your code impenetrable but adds a layer of obfuscation.
• Cleaner Binaries: Production binaries don't typically need debugging information, so stripping helps create a leaner, more focused distribution.

flowchart TD
    A[Original Shared Library] --> B{Contains Debug Symbols & Metadata}
    B -->|Yes| C[Run 'strip' Command]
    C --> D[Stripped Shared Library]
    D --> E{"Smaller Size, Obscured Internals"}
    B -->|No| E

Flowchart illustrating the stripping process for shared libraries.

Understanding the strip Command

The strip command is a standard utility found on most Unix-like systems, part of the GNU Binutils package. It modifies executable files and shared libraries by discarding symbols. It offers various options to control what information is removed. The most common usage is to remove all symbols, but you can also choose to keep certain types of symbols if needed.

# View symbols before stripping
nm -D libmylibrary.so | head -n 10

# Strip all symbols from a shared library
strip libmylibrary.so

# View symbols after stripping (should be empty or minimal)
nm -D libmylibrary.so

Basic usage of strip and nm to inspect symbols.

Advanced Stripping Options

The strip command provides several options for fine-grained control over what gets removed:

• -s or --strip-all: Remove all symbols (default behavior if no other stripping options are specified).
• -g or --strip-debug: Remove debugging symbols only. This is often a good compromise, as it keeps global and static symbols that might be useful for some forms of introspection or specific tools.
• -S or --strip-unneeded: Remove all symbols that are not needed for relocation processing. This is a more aggressive option than --strip-debug but less aggressive than --strip-all.
• -x or --discard-all: Remove all non-global symbols. This keeps only global symbols.

Choosing the right option depends on your specific needs. For most production deployments, --strip-all is common. If you anticipate needing some level of symbol information for crash analysis or specific tools, --strip-debug might be more appropriate.

# Strip only debugging symbols
strip --strip-debug libmylibrary.so

# Strip unneeded symbols (keeps some for relocation)
strip --strip-unneeded libmylibrary.so

Using specific strip options for finer control.

1. Compile Your Shared Library

First, compile your C++ source code into a shared library. Ensure you include debugging information during compilation (e.g., with -g) if you want to see the effect of stripping later.

2. Inspect Original Symbols

Use the nm -D command to list the dynamic symbols in your newly created shared library. This will show you the functions and variables that are currently exposed.

3. Strip the Library

Apply the strip command with your desired options (e.g., strip --strip-all or strip --strip-debug) to the shared library file. Remember to back it up first!

4. Verify Stripping

Re-run nm -D on the stripped library. You should observe a significant reduction or complete absence of symbols, depending on the strip options used. Also, check the file size difference using ls -lh.