ELF's gnu_debuglink section gives me weird name

Question

I've used Ubuntu 20.04.3, and when I run

readelf  --string-dump=.gnu_debuglink /usr/bin/cp

I got weird debug filename while expecting something like cp.debug

String dump of section '.gnu_debuglink':
  [     0]  674b3a5e9ca27e34cf3517aa997ba91ce6e0a0.debug
  [    31]  k`-

This is the original Ubuntu image, no modification at all. Is there any reason for this?

Answer 1

I got weird debug filename while expecting something like cp.debug

There is nothing weird about this name.

There are two common schemes for associating the program and debug info for that program -- name of the program, or its linker build-id.

You can find linker build-id with readelf -n /usr/bin/cp. Here is the output on my system:

Displaying notes found in: .note.gnu.build-id
  Owner                Data size        Description
  GNU                  0x00000014       NT_GNU_BUILD_ID (unique build ID bitstring)         Build ID: 2f6b630344b1b72875f756dce05a40186d18c6d8

Displaying notes found in: .note.ABI-tag
  Owner                Data size        Description
  GNU                  0x00000010       NT_GNU_ABI_TAG (ABI version tag)            OS: Linux, ABI: 3.2.0

Chances are, the linker build-id for your version of cp is 674b3a5e9ca27e34cf3517aa997ba91ce6e0a0.

Using linker build-id is especially convenient for programs which can appear under several different names (where using just the program name you would have to create several copies (or links) of the debug info).

Also, if the program is updated, its linker build-id will change, and so there is no chance that the "stale" debug info would be loaded by the debugger.