python-config --ldflags must not contain LINKFORSHARED.

Attached PR modifies python-config --ldflags to no longer include LINKFORSHARED.

This similar change was already made on macOS: see bpo-14197.

--

Python build system uses a LINKFORSHARED variable, extract of configure.ac:

# LINKFORSHARED are the flags passed to the $(CC) command that links
# the python executable -- this is only needed for a few systems

This variable is set to "-Xlinker -export-dynamic" on Linux. Extract of ld manual page for --export-dynamic option:
---
When creating a dynamically linked executable, using the -E
option or the --export-dynamic option causes the linker to
add all symbols to the dynamic symbol table. The dynamic
symbol table is the set of symbols which are visible from
dynamic objects at run time.

If you do not use either of these options (or use the
--no-export-dynamic option to restore the default behavior),
the dynamic symbol table will normally contain only those
symbols which are referenced by some dynamic object
mentioned in the link.

If you use "dlopen" to load a dynamic object which needs to
refer back to the symbols defined by the program, rather
than some other dynamic object, then you will probably need
to use this option when linking the program itself.

You can also use the dynamic list to control what symbols
should be added to the dynamic symbol table if the output
format supports it. See the description of --dynamic-list.

Note that this option is specific to ELF targeted ports. PE
targets support a similar function to export all symbols
from a DLL or EXE; see the description of
--export-all-symbols below.
---

Both configure.ac and ld manual page mention an "executable", whereas LINKFORSHARED is currently exported in python-config --ldflags. Example on Fedora 29:

$ python3-config --ldflags
 -L/usr/lib64 -lpython3.7m -lpthread -ldl  -lutil -lm  -Xlinker -export-dynamic

The "-export-dynamic" flag causes non-obvious dynamic linking bug like the following bug in Samba which embeds Python:

• https://bugzilla.redhat.com/show_bug.cgi?id=1198161 (python bug)
• https://bugzilla.redhat.com/show_bug.cgi?id=1198158 (bug reported on samba)
• https://bugzilla.redhat.com/show_bug.cgi?id=1197914 (bug originally reported on gdb)

--

History of the LINKFORSHARED variable.

(*) Python build system uses a LINKFORSHARED variable since this commit:

commit 7cc5abd
Author: Guido van Rossum <guido@python.org>
Date: Mon Sep 12 10:42:20 1994 +0000

Support shared library creation.

The value of the variable changed on Linux with:

commit b65a48e (HEAD)
Author: Guido van Rossum <guido@python.org>
Date: Wed Jun 14 18:21:23 1995 +0000

linux elf shlib; sys/wait.h; don't add -posix for NeXT

Extract of the configure.in change:

if test -z "$LINKFORSHARED"
then
case $ac_sys_system in
hp*|HP*) LINKFORSHARED="-Wl,-E";;
+ Linux*) LINKFORSHARED="-rdynamic";;
esac
fi

The variable was only used to build the "python" executable. Extract of Modules/Makefile.in (at commit 7cc5abd):

../python: config.o $(MYLIBS) Makefile
$(CC) $(OPT) config.o $(LINKFORSHARED) \
$(MYLIBS) $(MODLIBS) $(LIBS) $(SYSLIBS) -o python
mv python ../python

(*) The python-config script was created as a Python script by:

commit c90b17e
Author: Martin v. Löwis <martin@v.loewis.de>
Date: Sat Apr 15 08:13:05 2006 +0000

Patch bpo-1161914: Add python-config.

The following commit modified Misc/python-config.in to add LINKFORSHARED to python-config --ldflags:

commit a70f349
Author: Collin Winter <collinw@gmail.com>
Date: Fri Mar 19 00:08:44 2010 +0000

Make python-config support multiple option flags on the same command line, rather than requiring one invocation per flag.

Extract:

+ elif opt in ('--libs', '--ldflags'):
+ libs = getvar('LIBS').split() + getvar('SYSLIBS').split()
+ libs.append('-lpython'+pyver)
+ # add the prefix/lib/pythonX.Y/config dir, but only if there is no
+ # shared library in prefix/lib/.
+ if opt == '--ldflags':
+ if not getvar('Py_ENABLE_SHARED'):
+ libs.insert(0, '-L' + getvar('LIBPL'))
+ libs.extend(getvar('LINKFORSHARED').split())
+ print ' '.join(libs)

The following commit modified Misc/python-config.in to not add LINKFORSHARED into "libs" when built on macOS (if PYTHONFRAMEWORK is defined):

commit ecd4e9d
Author: Ned Deily <nad@acm.org>
Date: Tue Jul 24 03:31:48 2012 -0700

Issue bpo-14197: For OS X framework builds, ensure links to the shared
library are created with the proper ABI suffix.

diff --git a/Misc/python-config.in b/Misc/python-config.in
index 1d4a81d850..79f0bb14c1 100644
--- a/Misc/python-config.in
+++ b/Misc/python-config.in
@@ -52,7 +52,8 @@ for opt in opt_flags:
         if opt == '--ldflags':
             if not getvar('Py_ENABLE_SHARED'):
                 libs.insert(0, '-L' + getvar('LIBPL'))
-            libs.extend(getvar('LINKFORSHARED').split())
+            if not getvar('PYTHONFRAMEWORK'):
+                libs.extend(getvar('LINKFORSHARED').split())
         print(' '.join(libs))
 

(*) A shell version of python-config has been added by:

commit 8742119
Author: doko@python.org <doko@python.org>
Date: Sat Jan 26 11:39:31 2013 +0100

- Issue bpo-16235: Implement python-config as a shell script.

Extract of Misc/python-config.sh.in at this commit:

    --ldflags)
        LINKFORSHAREDUSED=
        if [ -z "$PYTHONFRAMEWORK" ] ; then
            LINKFORSHAREDUSED=$LINKFORSHARED
        fi
        LIBPLUSED=
        if [ "$PY_ENABLE_SHARED" = "0" ] ; then
            LIBPLUSED="-L$LIBPL"
        fi
        echo "$LIBPLUSED -L$libdir $LIBS $LINKFORSHAREDUSED"
    ;;

I'm a little bit scared by the idea of backporting such change in Python 2.7 and 3.7 stable branches, even if I think that it's a correct bugfix. I'm scared by the number of platforms, I don't know all these linker flags and I am not able to test all combinations:

AC_MSG_RESULT($CCSHARED)
# LINKFORSHARED are the flags passed to the $(CC) command that links
# the python executable -- this is only needed for a few systems
AC_MSG_CHECKING(LINKFORSHARED)
if test -z "$LINKFORSHARED"
then
	case $ac_sys_system/$ac_sys_release in
	AIX*)	LINKFORSHARED='-Wl,-bE:Modules/python.exp -lld';;
	hp*|HP*)
	    LINKFORSHARED="-Wl,-E -Wl,+s";;
#	    LINKFORSHARED="-Wl,-E -Wl,+s -Wl,+b\$(BINLIBDEST)/lib-dynload";;
	Linux-android*) LINKFORSHARED="-pie -Xlinker -export-dynamic";;
	Linux*|GNU*) LINKFORSHARED="-Xlinker -export-dynamic";;
	# -u libsys_s pulls in all symbols in libsys
	Darwin/*)
		LINKFORSHARED="$extra_undefs -framework CoreFoundation"

	\# Issue bpo-18075: the default maximum stack size (8MBytes) is too
	\# small for the default recursion limit. Increase the stack size
	\# to ensure that tests don't crash
	LINKFORSHARED="-Wl,-stack_size,1000000 $LINKFORSHARED"

	if test "$enable_framework"
	then
		LINKFORSHARED="$LINKFORSHARED "'$(PYTHONFRAMEWORKDIR)/Versions/$(VERSION)/$(PYTHONFRAMEWORK)'
	fi
	LINKFORSHARED="$LINKFORSHARED";;
OpenUNIX*|UnixWare*) LINKFORSHARED="-Wl,-Bexport";;
SCO_SV*) LINKFORSHARED="-Wl,-Bexport";;
ReliantUNIX*) LINKFORSHARED="-W1 -Blargedynsym";;
FreeBSD*|NetBSD*|OpenBSD*|DragonFly*)
	if [[ "`$CC -dM -E - </dev/null | grep __ELF__`" != "" ]]
	then
		LINKFORSHARED="-Wl,--export-dynamic"
	fi;;
SunOS/5*) case $CC in
	  *gcc*)
	    if $CC -Xlinker --help 2>&1 | grep export-dynamic >/dev/null
	    then
		LINKFORSHARED="-Xlinker --export-dynamic"
	    fi;;
	  esac;;
CYGWIN*)
	if test $enable_shared = "no"
	then
		LINKFORSHARED='-Wl,--out-implib=$(LDLIBRARY)'
	fi;;
QNX*)
	# -Wl,-E causes the symbols to be added to the dynamic
	# symbol table so that they can be found when a module
	# is loaded.  -N 2048K causes the stack size to be set
	# to 2048 kilobytes so that the stack doesn't overflow
	# when running test_compile.py.
	LINKFORSHARED='-Wl,-E -N 2048K';;
VxWorks*)
	LINKFORSHARED='--export-dynamic';;		
esac

fi
AC_MSG_RESULT($LINKFORSHARED)

See also bpo-10112: "Use -Wl,--dynamic-list=x.list, not -Xlinker -export-dynamic".

New changeset e65f01f by Victor Stinner in branch 'master':
bpo-36508: python-config don't export LINKFORSHARED (GH-12661)
e65f01f

New changeset cd46b09 by Victor Stinner (Miss Islington (bot)) in branch '3.7':
bpo-36508: python-config don't export LINKFORSHARED (GH-12661) (GH-12748)
cd46b09

The bug is fixed in 3.7 and master (future 3.8) branches. I prefer to leave 2.7 unchanged. I close the issue.

Python 2.7 is affected as well, but I'm really scared to touch the build system of Python 2.7 which is very stable. Even for Python 3.7, I wasn't fully comfortable to merge my fix.