osquery on OEL7 - ARM64 not working ( Error: symbol __cxa_thread_atexit_impl, version GLIBC_2.18 not defined in file libc.so.6 with link time reference)

[satyavvd]

Bug report

What operating system and version are you using?

$ uname -a Linux ci-arm64-agent-test-02 5.4.17-2136.307.3.1.el7uek.aarch64 #2 SMP Mon May 9 17:34:42 PDT 2022 aarch64 aarch64 aarch64 GNU/Linux

What version of osquery are you using?

$ rpm -qa | grep osq osquery-5.3.0-1.linux.aarch64

What steps did you take to reproduce the issue?

$ osqueryi osqueryi: relocation error: osqueryi: symbol __cxa_thread_atexit_impl, version GLIBC_2.18 not defined in file libc.so.6 with link time reference

What did you expect to see?

osquery prompt

What did you see instead?

Error : osqueryi: relocation error: osqueryi: symbol __cxa_thread_atexit_impl, version GLIBC_2.18 not defined in file libc.so.6 with link time reference

[Smjert]

@satyavvd Hello, this is expected; when doing the port to aarch64 for AWS Graviton, official AMIs have been used and back then Ubuntu 16.04 was the oldest one available, which uses glibc 2.23. So we don't support distributions older than that.

[ajaynair]

I was able to get osquery to work on arm64 OL7 by using a hackish solution. We can statically link glibc. My diff looks like this:

diff --git a/CMakeLists.txt b/CMakeLists.txt
index e5a7ca550..9ee454299 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -6,6 +6,8 @@
 # SPDX-License-Identifier: (Apache-2.0 OR GPL-2.0-only)

 cmake_minimum_required(VERSION 3.17.5 FATAL_ERROR)
+set(CMAKE_EXE_LINKER_FLAGS "-static-libgcc -static-libstdc++")
+set(CMAKE_FIND_LIBRARY_SUFFIXES ".a")

 cmake_policy(SET CMP0083 NEW)

diff --git a/cmake/flags.cmake b/cmake/flags.cmake
index e046e8b8d..edbded2a4 100644
--- a/cmake/flags.cmake
+++ b/cmake/flags.cmake
@@ -85,6 +85,7 @@ function(setupBuildFlags)
     set(posix_cxx_link_options
       -stdlib=libc++
       -ldl
+      -static
     )

     set(posix_c_compile_options
@@ -98,6 +99,7 @@ function(setupBuildFlags)
     target_link_options(cxx_settings INTERFACE
       ${posix_common_link_options}
       ${posix_cxx_link_options}
+      
     )
     target_link_libraries(cxx_settings INTERFACE

[Smjert]

@ajaynair I'm not sure how stable that will be, first of all you're statically linking in another C++ standard library (libstdc++), while osquery is built with libc++, and then statically linking glibc means too mixing two versions, because it will need to load the system one dynamically anyway.

The real alternative would be to obtain a newer toolchain with C++17 support, built for your platform and then build osquery with that.

[Sowmya-27]

Hi, i have got the same error osqueryi: relocation error: osqueryi: symbol __cxa_thread_atexit_impl, version GLIBC_2.18 not defined in file libc.so.6 with link time reference when running osqueryi on rhel7 ARM AMI instance What can be done to solve this?