Viewing Linux Library / Executable version info

Try:

ldconfig -p | grep lib32

If you see no output, this is because the linker cache (read the first paragraph of man ldconfig, and about the -p switch) does not reference /usr/lib32. I checked a ubuntu 12.04 system and that is not in there by default. You can add it to: /etc/ld.so.conf.d/libc.conf which may contain just /usr/local/lib. Run just ldconfig, then the -p command from above. You should see the stuff in /usr/lib32; now try your ldd on the 32-bit gstreamer lib again.

This would be hacky, but if it's a dynamically linked executable, you could set up a global preload in /etc/ld.so.preload which would only trigger a logging hook if it detected you were in the right executable.

Something like:

#define _XOPEN_SOURCE
#include <stdio.h>
#include <string.h>
#include <unistd.h>

#define TARGET "/some_executable"

__attribute__((constructor)) 
static void 
logger(int argc, char** argv){ 
    /*catch own argv right here and parent's later from /proc */

    static char buf[sizeof(TARGET)];

    readlink("/proc/self/exe", buf, sizeof(buf)-1);

    if ( 0==strcmp(TARGET, buf)){
        /* ... */
        syslog(/*...*/);
    }
}

The obvious disadvantage of this approach is it would slightly delay the execution of each dynamically linked executable on your system, but my measurements indicate the delay is quite small (<1ms where fork+exec costs about 2ms).

As for the dropped permission problem, you could have a small setuid-root binary that will unconditionally read and echo its grandparents proc files (the status file, most likely), possibly if and only if its parent is the executable whose parents you want to log. You could then spawn that setuid executable inside your logging hook to obtain the info on the executables parent (grandparent of the setuid helper).