1

I have a Tomcat webapp that needs LD_LIBRARY_PATH to be set.

I'm using RHEL6 and Tomcat6 (from yum package manager), the webapp is called adore-djatoka.

I'm starting tomcat by using a supplied script that exports a number of environment variables, but it appears that LD_LIBRARY_PATH is being unset, I think this is a security feature, as the init script is run by user "root" but tomcat is running as "tomcat".

When I restart tomcat I see the following line in the logfile "djatoka.log"

2013-01-04/10:25:04.118/EST [main] DEBUG envParams: LD_LIBRARY_PATH=null | null/kdu_compress

Which I read as telling me that the app is expecting LD_LIBRARY_PATH to be set, but finds it to be null, and hence it'll look for kdu_compress in the directory null/.

I have littered the startup script with echo so I can see that LD_LIBRARY_PATH is being set and exported, so I'm assuming it must be being unset.

There are a couple of scripts bundled with the webapp to test it's installed correctly and they run fine from the command line, but they are very short, they simply export the environment vars (including LD_LIBRARY_PATH) and make a call to java.

I've tried adding

LD_LIBRARY_PATH="/opt/adore-djatoka-1.1/lib/Linux-x86-64"
export LD_LIBRARY_PATH

to /usr/share/tomcat6/bin/setenv.sh

I've tried adding

LD_LIBRARY_PATH="/opt/adore-djatoka-1.1/lib/Linux-x86-64"

to `/etc/tomcat6/tomcat6.conf

LD_LIBRARY_PATH is already exported in the startup script which goes on to call /etc/init.d/tomcat6 [start/stop/restart]

I'm quite new to a few subjects here, so some guidance on how to get a better idea of where to look next, or which information would be useful to post will also be appreciated. I've already read "why LD_LIBRARY_PATH is bad"

So my question is how can I start up tomcat, so that it doesn't set LD_LIBRARY_PATH to null? or how can I re-set it to what I want, after it has been set to null? or how can I stop the webapp from being dependent on it?

Cheers,

2

What you actually needed was to put an appropriate flag into your JAVA_OPTS (which is a bit counterintuitive).

On a RHEL box, put this in /etc/sysconfig/tomcat6 or /etc/tomcat6/tomcat.conf

JAVA_OPTS="-Xminf0.1 -Xmaxf0.3 -Xms1536m -Xmx1536m -XX:MaxPermSize=512m -Djava.awt.headless=true -DdjatokaUri=//thing.example.com/adore-djatoka -Dkakadu.home=/opt/adore-djatoka/bin/Linux-x86-64 -DLD_LIBRARY_PATH=/opt/adore-djatoka/lib/Linux-x86-64"

You can verify that this is set in Java using the following:

# tr '\0' '\n' < /proc/$(pidof java)/environ

as well as seeing the following in the djatoka log:

2015-08-31/08:33:01.683/NZST [http-bio-8080-exec-1] DEBUG envParams: LD_LIBRARY_PATH=/opt/adore-djatoka/lib/Linux-x86-64 | /opt/adore-djatoka/bin/Linux-x86-64/kdu_expand

Or you can just set it globally (in a file such as /etc/ld.so.conf.d/adore-djatoka)

# echo "/opt/adore-djatoka/lib/Linux-x86-64" > /etc/ld.so.conf.d/adore-djatoka
# ldconfig
0

I eventually worked-around this issue by grabbing the source of the webapp, hardcoding the required path into the relevant line, compiling and redeploying.

The path in question was simply pulled out as a string in the source, so it wasn't required that it was stored in LD_LIBRARY_PATH.

To make it more portable, I should remove the hardcoding and replace it with a call to a custom environment variable set in a config script.

This means, to the best of my knowledge, the answer to "How do I set LD_LIBRARY_PATH environment variable, after it is unset within the scope of a setuid program" is, "You can't, unless the program itself has a facility for passing in this info after execution".

0

With TOMCAT 7, simply setting a couple of lines in the $CATALINA_HOME/conf/tomcat.conf solved the issue (where a library named e.g. Crypto becomes libCrypto.so) :

JAVA_OPTS="-Djava.library.path=/usr/share/tomcat/sharedLibs"
# NOTE: the above instructs only the JVM, the next is ALSO required by native libs to load dependent native libs! 
LD_LIBRARY_PATH="/usr/share/tomcat/sharedLibs"

Fact is, every <tag>="<value>" line in tomcat.conf becomes an "export <tag>=<value>" (e.g. reverse-engineer the Tomcat service start script: /etc/init.d/tomcat).

You can also overload the value globally in /etc/sysconfig/tomcat for all TOMCAT services you may have configured.

Hence, if the settings in tomcat.conf looks like having no effect, check what the /etc/sysconfig/tomcat possibly overload ...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.