It is possible that the library path might be hard coded in the binary.
From the RPATH Wikipedia Page
The dynamic linker of the GNU C Library and its derivative Embedded
GLIBC implement a rather complicated algorithm for searching for
shared libraries. The basic search order is:
- The (colon-separated) paths in the DT_RPATH dynamic section attribute of the binary if present and DT_RUNPATH attribute does not
exist.
- The (colon-separated) paths in the environment variable LD_LIBRARY_PATH, unless the executable is a setuid/setgid binary, in
which case it is ignored. LD_LIBRARY_PATH can be overridden by calling
the dynamic linker with the option --library-path (e.g.
/lib/ld-linux.so.2 --library-path $HOME/mylibs myprogram).
- The (colon-separated) paths in the DT_RUNPATH dynamic section attribute of the binary if present.
- Lookup based on the ldconfig cache file (often located at /etc/ld.so.cache) which contains a compiled list of candidate
libraries previously found in the augmented library path (set by
/etc/ld.so.conf). If, however, the binary was linked with the -z
nodeflib linker option, libraries in the default library paths are
skipped.
- In the trusted default path /lib, and then /usr/lib. If the binary was linked with the -z nodeflib linker option, this step is
skipped.
To see if a binary has an RPATH configured:
readelf -d filename Shows only data from the “dynamic” section
The “dynamic” section of the header is of interest because it contains
data used during the initial loading process, such as:
NEEDED: libraries needed by this module
RPATH: See “Loader search procedure” below
SONAME: If this module is a library, this item shows the “soname” of the library.
Source: The linux loader, and how it finds libraries: ld-linux and so on
To view all libraries in the ldconfig cache you can run
ldconfig -p
An example of RUNPATH set in a binary
$ readelf -d /opt/teamviewer9/tv_bin/TVGuiSlave.64 | grep -i RUNPATH
0x000000000000001d (RUNPATH) Library runpath: [${ORIGIN}/../lib]