VirusTotal / yara-python

The Python interface for YARA
http://virustotal.github.io/yara/
Apache License 2.0
637 stars 178 forks source link

Path confusion with libyara.so #261

Closed TheTechromancer closed 1 month ago

TheTechromancer commented 1 month ago

Hi, first off thanks for making this library. It's very useful!

In the latest version there seems to be an issue with the placement of libyara.so. It seems to be concatenating together two paths.

Docker

$ apt update; apt install yara
$ pip install yara
$ python
>>> import yara
Failed to import '/usr/local/lib/libyara.so'
PATH = /usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin;/usr/local/lib
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/local/lib/python3.11/site-packages/yara/__init__.py", line 7, in <module>
    from yara.rules import compile
  File "/usr/local/lib/python3.11/site-packages/yara/rules.py", line 17, in <module>
    from yara.libyara_wrapper import *
  File "/usr/local/lib/python3.11/site-packages/yara/libyara_wrapper.py", line 315, in <module>
    libyaradll = cdll.LoadLibrary(library)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/ctypes/__init__.py", line 454, in LoadLibrary
    return self._dlltype(name)
           ^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/ctypes/__init__.py", line 376, in __init__
    self._handle = _dlopen(self._name, mode)
                   ^^^^^^^^^^^^^^^^^^^^^^^^^
OSError: /usr/local/lib/libyara.so: cannot open shared object file: No such file or directory

As you can see, the package is looking for yara.so in /usr/local/lib, but the actual location of the file is /usr/local/lib/python3.11/site-packages/usr/local/lib/libyara.so.

Local system

The same thing happens as a non-root user in a virtual environment. For example, when installing yara inside a poetry venv, it's looking for /home/user/.cache/pypoetry/virtualenvs/<venv>/lib/libyara.so, but the actual file is in /home/user/.cache/pypoetry/virtualenvs/<venv>/lib/python3.12/site-packages/home/user/.cache/pypoetry/virtualenvs/<venv>/lib/libyara.so

wxsBSD commented 1 month ago

I think, based upon the ctypes in the backtrace, you installed the wrong python package. You want to install yara-python.

TheTechromancer commented 1 month ago

Oh, derp. Thanks!