tree-wide: embed dlopen notes into individual executables

Previously, when a library was dynamically loaded via a helper function
inside libsystemd-shared.so, the resulting dlopen ELF note was not
propagated to the invoking executable's ELF metadata.

This commit explicitly annotates each executable with the relevant
dlopen ELF notes for any optional dependencies it might potentially
load. This ensures that package managers and build systems can properly
discover runtime dependencies that are triggered indirectly.

src/analyze/analyze.c

@@ -55,6 +55,7 @@
 #include "bus-util.h"
 #include "calendarspec.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "extract-word.h"
 #include "format-table.h"
 #include "help-util.h"
@@ -685,6 +686,20 @@ static int run(int argc, char *argv[]) {
         _cleanup_strv_free_ char **args = NULL;
         int r;
 
+        LIBACL_NOTE(recommended);
+        LIBAPPARMOR_NOTE(recommended);
+        LIBAUDIT_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBBPF_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(recommended);
+        LIBDW_NOTE(suggested);
+        LIBELF_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBPCRE2_NOTE(suggested);
+        LIBSELINUX_NOTE(recommended);
+        TPM2_NOTE(suggested);
+
         setlocale(LC_ALL, "");
         setlocale(LC_NUMERIC, "C"); /* we want to format/parse floats in C style */
 

src/bless-boot/bless-boot.c

@@ -5,6 +5,7 @@
 #include "alloc-util.h"
 #include "build.h"
 #include "devnum-util.h"
+#include "dlopen-note.h"
 #include "efivars.h"
 #include "fd-util.h"
 #include "find-esp.h"
@@ -566,6 +567,8 @@ static int run(int argc, char *argv[]) {
         char **args = NULL;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+
         log_setup();
 
         r = parse_argv(argc, argv, &args);

src/bootctl/bootctl.c

@@ -22,6 +22,7 @@
 #include "crypto-util.h"
 #include "devnum-util.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "efi-loader.h"
 #include "efivars.h"
 #include "escape.h"
@@ -858,6 +859,13 @@ static int run(int argc, char *argv[]) {
         _cleanup_(umount_and_freep) char *mounted_dir = NULL;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBTSS2_ESYS_NOTE(suggested);
+        LIBTSS2_MU_NOTE(suggested);
+        LIBTSS2_RC_NOTE(suggested);
+
         log_setup();
 
         char **args = NULL;

src/core/executor.c

@@ -9,6 +9,7 @@
 #include "build.h"
 #include "capability-util.h"
 #include "cgroup.h"
+#include "dlopen-note.h"
 #include "dynamic-user.h"
 #include "exec-invoke.h"
 #include "execute.h"
@@ -232,6 +233,12 @@ static int run(int argc, char *argv[]) {
 int run_executor(int argc, char *argv[]) {
         int r;
 
+        LIBACL_NOTE(recommended);
+        LIBAPPARMOR_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+        TPM2_NOTE(suggested);
+
         /* We use safe_fork() for spawning sd-pam helper process, which internally calls rename_process().
          * As the last step of renaming, all saved argvs are memzero()-ed. Hence, we need to save the argv
          * first to prevent showing "intense" cmdline. See #30352. */

src/core/main.c

@@ -41,6 +41,7 @@
 #include "dbus.h"
 #include "dbus-manager.h"
 #include "dev-setup.h"
+#include "dlopen-note.h"
 #include "efi-random.h"
 #include "emergency-action.h"
 #include "env-util.h"
@@ -4018,6 +4019,18 @@ finish:
 }
 
 int main(int argc, char *argv[]) {
+        LIBACL_NOTE(recommended);
+        LIBAPPARMOR_NOTE(recommended);
+        LIBAUDIT_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBBPF_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(recommended);
+        LIBKMOD_NOTE(recommended);
+        LIBPCRE2_NOTE(suggested);
+        LIBSECCOMP_NOTE(recommended);
+        TPM2_NOTE(suggested);
+
 #if SYSTEMD_MULTICALL_BINARY
         if (invoked_as(argv, "executor"))
                 return run_executor(argc, argv);

src/coredump/coredump.c

@@ -6,6 +6,7 @@
 #include "coredump-kernel-helper.h"
 #include "coredump-receive.h"
 #include "coredump-util.h"
+#include "dlopen-note.h"
 #include "log.h"
 #include "main-func.h"
 #include "string-util.h"
@@ -13,6 +14,12 @@
 static int run(int argc, char *argv[]) {
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBACL_NOTE(recommended);
+        LIBDW_NOTE(suggested);
+        LIBELF_NOTE(suggested);
+        LIBSELINUX_NOTE(recommended);
+
         /* When running as backtrace mode, it is not necessary to use kmsg, not necessary to disable coredump
          * from the command, and unexpectedly passed file descriptors can be silently ignored. */
         if (streq_ptr(argv[1], "--backtrace"))

src/coredump/coredumpctl.c

@@ -21,6 +21,7 @@
 #include "chase.h"
 #include "compress.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "escape.h"
 #include "extract-word.h"
@@ -1489,6 +1490,13 @@ static int run(int argc, char *argv[]) {
         char **args = NULL;
         int r, units_active;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBACL_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+
         setlocale(LC_ALL, "");
         log_setup();
 

src/creds/creds.c

@@ -12,6 +12,7 @@
 #include "bus-util.h"
 #include "creds-util.h"
 #include "dirent-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "escape.h"
 #include "fileio.h"
@@ -1467,6 +1468,9 @@ static int vl_server(void) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBCRYPTO_NOTE(suggested);
+        TPM2_NOTE(suggested);
+
         log_setup();
 
         char **args = NULL;

src/cryptenroll/cryptenroll.c

@@ -21,6 +21,7 @@
 #include "cryptenroll-varlink.h"
 #include "cryptenroll-wipe.h"
 #include "cryptsetup-util.h"
+#include "dlopen-note.h"
 #include "extract-word.h"
 #include "format-table.h"
 #include "help-util.h"
@@ -1019,6 +1020,13 @@ static int run(int argc, char *argv[]) {
         _cleanup_(enroll_context_done) EnrollContext c = ENROLL_CONTEXT_NULL;
         int slot, r;
 
+        LIBCRYPTO_NOTE(suggested);
+        LIBFIDO2_NOTE(suggested);
+        LIBP11KIT_NOTE(suggested);
+        LIBQRENCODE_NOTE(suggested);
+        PASSWORD_NOTE(suggested);
+        TPM2_NOTE(suggested);
+
         log_setup();
 
         /* A delicious drop of snake oil */

src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-fido2.c

@@ -8,6 +8,7 @@
 #include "alloc-util.h"
 #include "cryptsetup-token.h"
 #include "cryptsetup-token-util.h"
+#include "dlopen-note.h"
 #include "luks2-fido2.h"
 #include "memory-util.h"
 #include "version.h"
@@ -17,7 +18,9 @@
 #define TOKEN_VERSION_MINOR "0"
 
 /* for libcryptsetup debug purpose */
-_public_ const char *cryptsetup_token_version(void) {
+_public_ const char* cryptsetup_token_version(void) {
+        LIBFIDO2_NOTE(suggested);
+
         return TOKEN_VERSION_MAJOR "." TOKEN_VERSION_MINOR " systemd-v" PROJECT_VERSION_FULL " (" GIT_VERSION ")";
 }
 

src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-pkcs11.c

@@ -7,6 +7,7 @@
 #include "alloc-util.h"
 #include "cryptsetup-token.h"
 #include "cryptsetup-token-util.h"
+#include "dlopen-note.h"
 #include "luks2-pkcs11.h"
 #include "memory-util.h"
 #include "pkcs11-util.h"
@@ -17,7 +18,10 @@
 #define TOKEN_VERSION_MINOR "0"
 
 /* for libcryptsetup debug purpose */
-_public_ const char *cryptsetup_token_version(void) {
+_public_ const char* cryptsetup_token_version(void) {
+        LIBCRYPTO_NOTE(suggested);
+        LIBP11KIT_NOTE(suggested);
+
         return TOKEN_VERSION_MAJOR "." TOKEN_VERSION_MINOR " systemd-v" PROJECT_VERSION_FULL " (" GIT_VERSION ")";
 }
 

src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c

@@ -5,6 +5,7 @@
 #include "alloc-util.h"
 #include "cryptsetup-token.h"
 #include "cryptsetup-token-util.h"
+#include "dlopen-note.h"
 #include "hexdecoct.h"
 #include "json-util.h"
 #include "luks2-tpm2.h"
@@ -18,7 +19,9 @@
 #define TOKEN_VERSION_MINOR "0"
 
 /* for libcryptsetup debug purpose */
-_public_ const char *cryptsetup_token_version(void) {
+_public_ const char* cryptsetup_token_version(void) {
+        LIBCRYPTO_NOTE(suggested);
+        TPM2_NOTE(suggested);
 
         return TOKEN_VERSION_MAJOR "." TOKEN_VERSION_MINOR " systemd-v" PROJECT_VERSION_FULL " (" GIT_VERSION ")";
 }

src/cryptsetup/cryptsetup.c

@@ -18,6 +18,7 @@
 #include "cryptsetup-pkcs11.h"
 #include "cryptsetup-tpm2.h"
 #include "cryptsetup-util.h"
+#include "dlopen-note.h"
 #include "efi-api.h"
 #include "efi-loader.h"
 #include "efivars.h"
@@ -2884,6 +2885,12 @@ static int verb_detach(int argc, char *argv[], uintptr_t _data, void *userdata)
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBFIDO2_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBP11KIT_NOTE(suggested);
+        TPM2_NOTE(suggested);
+
         log_setup();
 
         umask(0022);

src/debug-generator/debug-generator.c

@@ -5,6 +5,7 @@
 #include "alloc-util.h"
 #include "bitfield.h"
 #include "creds-util.h"
+#include "dlopen-note.h"
 #include "dropin.h"
 #include "errno-util.h"
 #include "extract-word.h"
@@ -364,6 +365,9 @@ static int run(const char *dest, const char *dest_early, const char *dest_late)
         const char *credentials_dir;
         int r;
 
+        LIBCRYPTO_NOTE(suggested);
+        TPM2_NOTE(suggested);
+
         assert_se(arg_dest = dest_early);
 
         r = proc_cmdline_parse(parse_proc_cmdline_item, NULL, PROC_CMDLINE_RD_STRICT | PROC_CMDLINE_STRIP_RD_PREFIX);

src/dissect/dissect.c

@@ -19,6 +19,7 @@
 #include "device-util.h"
 #include "discover-image.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "errno-util.h"
 #include "escape.h"
@@ -1968,6 +1969,13 @@ static int run(int argc, char *argv[]) {
         _cleanup_close_ int userns_fd = -EBADF;
         int r;
 
+        LIBACL_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         if (invoked_as(argv, "mount.ddi"))

src/firstboot/firstboot.c

@@ -20,6 +20,7 @@
 #include "copy.h"
 #include "creds-util.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "env-file.h"
 #include "errno-util.h"
 #include "fd-util.h"
@@ -1702,6 +1703,14 @@ static int run(int argc, char *argv[]) {
         _cleanup_close_ int rfd = -EBADF;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPT_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+        PASSWORD_NOTE(suggested);
+
         r = parse_argv(argc, argv);
         if (r <= 0)
                 return r;

src/fstab-generator/fstab-generator.c

@@ -14,6 +14,7 @@
 #include "bus-util.h"
 #include "chase.h"
 #include "creds-util.h"
+#include "dlopen-note.h"
 #include "efi-loader.h"
 #include "env-util.h"
 #include "errno-util.h"
@@ -1729,6 +1730,11 @@ static int run_generator(void) {
 }
 
 static int run(int argc, char **argv) {
+        LIBCRYPTO_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+        TPM2_NOTE(suggested);
+
         arg_sysroot_check = invoked_as(argv, "systemd-sysroot-fstab-check");
 
         if (arg_sysroot_check) {

src/getty-generator/getty-generator.c

@@ -5,6 +5,7 @@
 
 #include "alloc-util.h"
 #include "creds-util.h"
+#include "dlopen-note.h"
 #include "extract-word.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -277,6 +278,9 @@ static int run(const char *dest, const char *dest_early, const char *dest_late)
 
         assert_se(arg_dest = dest);
 
+        LIBCRYPTO_NOTE(suggested);
+        TPM2_NOTE(suggested);
+
         if (in_initrd()) {
                 log_debug("Skipping generator, running in the initrd.");
                 return EXIT_SUCCESS;

src/gpt-auto-generator/gpt-auto-generator.c

@@ -9,6 +9,7 @@
 #include "device-util.h"
 #include "devnum-util.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "dropin.h"
 #include "efi-loader.h"
 #include "efivars.h"
@@ -1359,6 +1360,10 @@ static int parse_proc_cmdline_item(const char *key, const char *value, void *dat
 static int run(const char *dest, const char *dest_early, const char *dest_late) {
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         assert_se(arg_dest = dest);
         assert_se(arg_dest_late = dest_late);
 

src/growfs/growfs.c

@@ -11,6 +11,7 @@
 #include "device-util.h"
 #include "devnum-util.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "fd-util.h"
 #include "format-table.h"
 #include "format-util.h"
@@ -192,6 +193,8 @@ static int run(int argc, char *argv[]) {
         dev_t devno;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+
         log_setup();
 
         r = parse_argv(argc, argv);

src/growfs/makefs.c

@@ -7,6 +7,7 @@
 #include "alloc-util.h"
 #include "blockdev-util.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "fd-util.h"
 #include "log.h"
 #include "main-func.h"
@@ -20,6 +21,9 @@ static int run(int argc, char *argv[]) {
         struct stat st;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBMOUNT_NOTE(recommended);
+
         log_setup();
 
         if (argc != 3)

src/home/homectl.c

@@ -19,6 +19,7 @@
 #include "creds-util.h"
 #include "crypto-util.h"
 #include "dirent-util.h"
+#include "dlopen-note.h"
 #include "dns-domain.h"
 #include "env-util.h"
 #include "errno-util.h"
@@ -5183,6 +5184,12 @@ static int run(int argc, char *argv[]) {
         char **args = NULL;
         int r;
 
+        LIBCRYPT_NOTE(recommended);
+        LIBFIDO2_NOTE(suggested);
+        LIBP11KIT_NOTE(suggested);
+        LIBQRENCODE_NOTE(suggested);
+        PASSWORD_NOTE(suggested);
+
         log_setup();
 
         r = redirect_bus_mgr();

src/home/homed.c

@@ -7,6 +7,7 @@
 #include "bus-log-control-api.h"
 #include "bus-object.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "homed-manager.h"
 #include "homed-manager-bus.h"
 #include "log.h"
@@ -18,6 +19,9 @@ static int run(int argc, char *argv[]) {
         _unused_ _cleanup_(notify_on_cleanup) const char *notify_stop = NULL;
         int r;
 
+        LIBCRYPT_NOTE(recommended);
+        PASSWORD_NOTE(suggested);
+
         log_setup();
 
         r = service_parse_argv("systemd-homed.service",

src/home/homework.c

@@ -13,6 +13,7 @@
 #include "chown-recursive.h"
 #include "copy.h"
 #include "cryptsetup-util.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "errno-util.h"
 #include "fd-util.h"
@@ -1998,6 +1999,12 @@ static int run(int argc, char *argv[]) {
         sd_json_variant *fdmap, *blob_fd_variant;
         int r;
 
+        LIBCRYPT_NOTE(recommended);
+        LIBFIDO2_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBP11KIT_NOTE(suggested);
+        LIBSELINUX_NOTE(recommended);
+
         start = now(CLOCK_MONOTONIC);
 
         log_setup();

src/hostname/hostnamed.c

@@ -22,6 +22,7 @@
 #include "daemon-util.h"
 #include "device-private.h"
 #include "device-util.h"
+#include "dlopen-note.h"
 #include "env-file.h"
 #include "env-util.h"
 #include "extract-word.h"
@@ -2659,6 +2660,8 @@ static int run(int argc, char *argv[]) {
         };
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         r = service_parse_argv("systemd-hostnamed.service",

src/hwdb/hwdb.c

@@ -2,6 +2,7 @@
 
 #include "alloc-util.h"
 #include "build.h"
+#include "dlopen-note.h"
 #include "format-table.h"
 #include "hwdb-util.h"
 #include "label-util.h"
@@ -114,6 +115,8 @@ static int parse_argv(int argc, char *argv[], char ***ret_args) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         char **args = NULL;

src/import/export.c

@@ -9,6 +9,7 @@
 #include "ansi-color.h"
 #include "build.h"
 #include "discover-image.h"
+#include "dlopen-note.h"
 #include "export-raw.h"
 #include "export-tar.h"
 #include "fd-util.h"
@@ -282,6 +283,9 @@ static int parse_argv(int argc, char *argv[], char ***ret_args) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        ARCHIVE_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         setlocale(LC_ALL, "");
         log_setup();
 

src/import/import-fs.c

@@ -9,6 +9,7 @@
 #include "build.h"
 #include "copy.h"
 #include "discover-image.h"
+#include "dlopen-note.h"
 #include "fd-util.h"
 #include "format-table.h"
 #include "format-util.h"
@@ -392,6 +393,8 @@ static int parse_argv(int argc, char *argv[], char ***ret_args) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         setlocale(LC_ALL, "");
         log_setup();
 

src/import/import-generator.c

@@ -5,6 +5,7 @@
 #include "alloc-util.h"
 #include "creds-util.h"
 #include "discover-image.h"
+#include "dlopen-note.h"
 #include "efivars.h"
 #include "errno-util.h"
 #include "extract-word.h"
@@ -426,6 +427,9 @@ static int generate(void) {
 static int run(const char *dest, const char *dest_early, const char *dest_late) {
         int r;
 
+        LIBCRYPTO_NOTE(suggested);
+        TPM2_NOTE(suggested);
+
         assert_se(arg_dest = dest);
 
         r = proc_cmdline_parse(parse_proc_cmdline_item, NULL, PROC_CMDLINE_RD_STRICT|PROC_CMDLINE_STRIP_RD_PREFIX);

src/import/import.c

@@ -9,6 +9,7 @@
 #include "ansi-color.h"
 #include "build.h"
 #include "discover-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "fd-util.h"
 #include "format-table.h"
@@ -469,6 +470,9 @@ static void parse_env(void) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        ARCHIVE_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         setlocale(LC_ALL, "");
         log_setup();
 

src/import/importd.c

@@ -19,6 +19,7 @@
 #include "constants.h"
 #include "daemon-util.h"
 #include "discover-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "event-util.h"
 #include "fd-util.h"
@@ -2081,6 +2082,8 @@ static int run(int argc, char *argv[]) {
         RuntimeScope scope = RUNTIME_SCOPE_SYSTEM;
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         r = service_parse_argv("systemd-importd.service",

src/import/pull.c

@@ -9,6 +9,7 @@
 #include "ansi-color.h"
 #include "build.h"
 #include "discover-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "format-table.h"
 #include "hexdecoct.h"
@@ -608,6 +609,10 @@ static void parse_env(void) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        ARCHIVE_NOTE(recommended);
+        LIBCURL_NOTE(suggested);
+        LIBSELINUX_NOTE(recommended);
+
         setlocale(LC_ALL, "");
         log_setup();
 

src/journal-remote/journal-gatewayd.c

@@ -1259,6 +1259,9 @@ static int run(int argc, char *argv[]) {
                 MHD_USE_THREAD_PER_CONNECTION;
         int r, n;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBGNUTLS_NOTE(suggested);
+
         log_setup();
 
         r = parse_argv(argc, argv);

src/journal-remote/journal-remote-main.c

@@ -9,6 +9,7 @@
 #include "build.h"
 #include "conf-parser.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "extract-word.h"
 #include "fd-util.h"
 #include "format-table.h"
@@ -1165,6 +1166,11 @@ static int run(int argc, char **argv) {
         _cleanup_free_ char *cert = NULL, *trust = NULL;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBCRYPTO_NOTE(suggested);
+        LIBGNUTLS_NOTE(suggested);
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         journal_auth_init();

src/journal-remote/journal-upload.c

@@ -12,6 +12,7 @@
 #include "conf-parser.h"
 #include "curl-util.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "env-file.h"
 #include "extract-word.h"
 #include "fd-util.h"
@@ -869,6 +870,8 @@ static int run(int argc, char **argv) {
         bool use_journal;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+
         log_setup();
 
         r = parse_config();

src/journal/bsod.c

@@ -8,6 +8,7 @@
 
 #include "alloc-util.h"
 #include "build.h"
+#include "dlopen-note.h"
 #include "fd-util.h"
 #include "fileio.h"
 #include "format-table.h"
@@ -287,6 +288,9 @@ static int run(int argc, char *argv[]) {
         _cleanup_free_ char *message = NULL;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBQRENCODE_NOTE(suggested);
+
         log_setup();
 
         r = parse_argv(argc, argv);

src/journal/journalctl.c

@@ -7,6 +7,7 @@
 
 #include "build.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "extract-word.h"
 #include "format-table.h"
 #include "glob-util.h"
@@ -1021,6 +1022,14 @@ static int run(int argc, char *argv[]) {
         _cleanup_strv_free_ char **args = NULL;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBACL_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBPCRE2_NOTE(suggested);
+        LIBQRENCODE_NOTE(suggested);
+
         setlocale(LC_ALL, "");
         log_setup();
 

src/journal/journald.c

@@ -6,6 +6,7 @@
 #include "sd-event.h"
 #include "sd-messages.h"
 
+#include "dlopen-note.h"
 #include "format-util.h"
 #include "journal-authenticate.h"
 #include "journald-kmsg.h"
@@ -25,6 +26,12 @@ static int run(int argc, char *argv[]) {
         LogTarget log_target;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBACL_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBPCRE2_NOTE(suggested);
+        LIBSELINUX_NOTE(recommended);
+
         if (argc > 2)
                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "This program takes one or no arguments.");
 

src/kernel-install/kernel-install.c

@@ -12,6 +12,7 @@
 #include "chase.h"
 #include "conf-files.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "env-file.h"
 #include "env-util.h"
 #include "exec-util.h"
@@ -1664,6 +1665,11 @@ static int parse_argv(int argc, char *argv[], char ***remaining_args) {
 static int run(int argc, char* argv[]) {
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+
         log_setup();
 
         char **args = NULL;

src/locale/localed.c

@@ -15,6 +15,7 @@
 #include "bus-util.h"
 #include "constants.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "hashmap.h"
 #include "label-util.h"
 #include "localed-util.h"
@@ -632,6 +633,8 @@ static int run(int argc, char *argv[]) {
         _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         r = service_parse_argv("systemd-localed.service",

src/login/loginctl.c

@@ -17,6 +17,7 @@
 #include "bus-util.h"
 #include "cgroup-show.h"
 #include "cgroup-util.h"
+#include "dlopen-note.h"
 #include "format-table.h"
 #include "format-util.h"
 #include "help-util.h"
@@ -1661,6 +1662,8 @@ static int run(int argc, char *argv[]) {
         char **args = NULL;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+
         setlocale(LC_ALL, "");
         log_setup();
 

src/login/logind.c

@@ -17,6 +17,7 @@
 #include "device-util.h"
 #include "devnum-util.h"
 #include "dirent-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "escape.h"
 #include "fd-util.h"
@@ -1351,6 +1352,10 @@ static int run(int argc, char *argv[]) {
         _unused_ _cleanup_(notify_on_cleanup) const char *notify_message = NULL;
         int r;
 
+        LIBACL_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         log_set_facility(LOG_AUTH);
         log_setup();
 

src/login/user-runtime-dir.c

@@ -8,6 +8,7 @@
 #include "bus-error.h"
 #include "bus-locator.h"
 #include "devnum-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "format-util.h"
@@ -327,6 +328,9 @@ static int do_tmpfs_quota(UserRecord *ur) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         if (argc != 3)

src/machine-id-setup/machine-id-setup-main.c

@@ -5,6 +5,7 @@
 #include "alloc-util.h"
 #include "build.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "format-table.h"
 #include "id128-util.h"
 #include "image-policy.h"
@@ -131,6 +132,12 @@ static int run(int argc, char *argv[]) {
         _cleanup_(umount_and_freep) char *mounted_dir = NULL;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        TPM2_NOTE(suggested);
+
         log_setup();
 
         r = parse_argv(argc, argv);

src/machine/machinectl.c

@@ -26,6 +26,7 @@
 #include "bus-wait-for-jobs.h"
 #include "cgroup-show.h"
 #include "cgroup-util.h"
+#include "dlopen-note.h"
 #include "edit-util.h"
 #include "env-util.h"
 #include "fd-util.h"
@@ -2634,6 +2635,9 @@ static int run(int argc, char *argv[]) {
         _cleanup_strv_free_ char **args = NULL;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBSELINUX_NOTE(recommended);
+
         setlocale(LC_ALL, "");
         log_setup();
 

src/machine/machined.c

@@ -16,6 +16,7 @@
 #include "constants.h"
 #include "daemon-util.h"
 #include "dirent-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "hash-funcs.h"
@@ -347,6 +348,12 @@ static int run(int argc, char *argv[]) {
         RuntimeScope scope = RUNTIME_SCOPE_SYSTEM;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         log_set_facility(LOG_AUTH);
         log_setup();
 

src/measure/measure-tool.c

@@ -8,6 +8,7 @@
 #include "ask-password-api.h"
 #include "build.h"
 #include "crypto-util.h"
+#include "dlopen-note.h"
 #include "efi-loader.h"
 #include "efivars.h"
 #include "fd-util.h"
@@ -1130,6 +1131,8 @@ static int verb_policy_digest(int argc, char *argv[], uintptr_t _data, void *use
 static int run(int argc, char *argv[]) {
         int r;
 
+        TPM2_NOTE(suggested);
+
         log_setup();
 
         char **args = NULL;

src/modules-load/modules-load.c

@@ -12,6 +12,7 @@
 #include "conf-files.h"
 #include "constants.h"
 #include "cpu-set-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -390,6 +391,8 @@ static int run(int argc, char *argv[]) {
         char *module;
         int ret = 0, r;
 
+        LIBKMOD_NOTE(required);
+
         char **args = NULL;
         r = parse_argv(argc, argv, &args);
         if (r <= 0)

src/mount/mount-tool.c

@@ -14,6 +14,7 @@
 #include "chase.h"
 #include "device-private.h"
 #include "device-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "escape.h"
 #include "fd-util.h"
@@ -1479,6 +1480,8 @@ static int run(int argc, char* argv[]) {
         char **args = NULL;
         int r;
 
+        LIBMOUNT_NOTE(recommended);
+
         log_setup();
 
         r = parse_argv(argc, argv, &args);

src/mountfsd/mountwork.c

@@ -15,6 +15,7 @@
 #include "chase.h"
 #include "discover-image.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "errno-util.h"
 #include "escape.h"
@@ -1489,6 +1490,11 @@ static int run(int argc, char *argv[]) {
         unsigned n_iterations = 0;
         int m, listen_fd, r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+
         log_setup();
 
         m = sd_listen_fds(false);

src/mstack/mstack-tool.c

@@ -6,6 +6,7 @@
 #include "argv-util.h"
 #include "build.h"
 #include "chase.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "extract-word.h"
 #include "fd-util.h"
@@ -376,6 +377,11 @@ static int umount_mstack(void) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+
         log_setup();
 
         if (invoked_as(argv, "mount.mstack"))

src/network/generator/network-generator-main.c

@@ -5,6 +5,7 @@
 #include "alloc-util.h"
 #include "build.h"
 #include "creds-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "format-table.h"
@@ -197,6 +198,8 @@ static int run(int argc, char *argv[]) {
         _cleanup_(context_clear) Context context = {};
         int r, ret = 0;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         umask(0022);

src/network/networkctl.c

@@ -4,6 +4,7 @@
 
 #include "alloc-util.h"
 #include "build.h"
+#include "dlopen-note.h"
 #include "format-table.h"
 #include "help-util.h"
 #include "log.h"
@@ -208,6 +209,9 @@ static int run(int argc, char* argv[]) {
         char **args = NULL;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         r = parse_argv(argc, argv, &args);

src/network/networkd.c

@@ -9,6 +9,7 @@
 #include "bus-object.h"
 #include "capability-util.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "main-func.h"
 #include "mkdir.h"
 #include "networkd-conf.h"
@@ -24,6 +25,15 @@ static int run(int argc, char *argv[]) {
         _unused_ _cleanup_(notify_on_cleanup) const char *notify_message = NULL;
         int r;
 
+        LIBAPPARMOR_NOTE(recommended);
+        LIBAUDIT_NOTE(recommended);
+        LIBIDN2_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+        LIBTSS2_ESYS_NOTE(suggested);
+        LIBTSS2_MU_NOTE(suggested);
+        LIBTSS2_RC_NOTE(suggested);
+
         log_setup();
 
         r = service_parse_argv("systemd-networkd.service",

src/nspawn/meson.build

@@ -47,7 +47,11 @@ executables += [
                         executable_template['include_directories'],
                 ],
                 'dependencies' : [
+                        libacl_cflags,
+                        libblkid_cflags,
+                        libcryptsetup_cflags,
                         libmount_cflags,
+                        libopenssl_cflags,
                         libseccomp_cflags,
                         libselinux_cflags,
                 ],

src/nspawn/nspawn.c

@@ -20,9 +20,11 @@
 #include "sd-path.h"
 #include "sd-varlink.h"
 
+#include "acl-util.h"
 #include "alloc-util.h"
 #include "barrier.h"
 #include "base-filesystem.h"
+#include "blkid-util.h"
 #include "btrfs-util.h"
 #include "build.h"
 #include "bus-error.h"
@@ -36,12 +38,13 @@
 #include "constants.h"
 #include "copy.h"
 #include "cpu-set-util.h"
+#include "crypto-util.h"
+#include "cryptsetup-util.h"
 #include "daemon-util.h"
 #include "dev-setup.h"
 #include "devnum-util.h"
 #include "discover-image.h"
 #include "dissect-image.h"
-#include "dlfcn-util.h"
 #include "env-util.h"
 #include "escape.h"
 #include "ether-addr-util.h"
@@ -6141,6 +6144,10 @@ static int run(int argc, char *argv[]) {
         if (arg_cleanup)
                 return do_cleanup();
 
+        (void) DLOPEN_CRYPTSETUP(LOG_DEBUG, suggested);
+        (void) DLOPEN_LIBACL(LOG_DEBUG, recommended);
+        (void) DLOPEN_LIBBLKID(LOG_DEBUG, recommended);
+        (void) DLOPEN_LIBCRYPTO(LOG_WARNING, recommended);
         (void) DLOPEN_LIBMOUNT(LOG_DEBUG, recommended);
         (void) DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended);
         (void) DLOPEN_LIBSELINUX(LOG_DEBUG, recommended);

src/pcrextend/pcrextend.c

@@ -7,6 +7,7 @@
 #include "alloc-util.h"
 #include "build.h"
 #include "crypto-util.h"
+#include "dlopen-note.h"
 #include "efi-loader.h"
 #include "escape.h"
 #include "format-table.h"
@@ -512,6 +513,9 @@ static int run(int argc, char *argv[]) {
         Tpm2UserspaceEventType event = _TPM2_USERSPACE_EVENT_TYPE_INVALID;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        TPM2_NOTE(suggested);
+
         log_setup();
 
         char **args = NULL;

src/pcrlock/pcrlock.c

@@ -21,6 +21,7 @@
 #include "copy.h"
 #include "creds-util.h"
 #include "crypto-util.h"
+#include "dlopen-note.h"
 #include "efi-api.h"
 #include "efivars.h"
 #include "env-util.h"
@@ -5698,6 +5699,10 @@ static int vl_method_on_completed_update(sd_varlink *link, sd_json_variant *para
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+        TPM2_NOTE(suggested);
+
         log_setup();
 
         r = mac_init();

src/portable/portabled.c

@@ -12,6 +12,7 @@
 #include "common-signal.h"
 #include "constants.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "hashmap.h"
 #include "log.h"
 #include "main-func.h"
@@ -143,6 +144,10 @@ static int run(int argc, char *argv[]) {
         RuntimeScope scope = RUNTIME_SCOPE_SYSTEM;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         r = service_parse_argv("systemd-portabled.service",

src/pstore/pstore.c

@@ -13,6 +13,7 @@
 #include "conf-parser.h"
 #include "copy.h"
 #include "dirent-util.h"
+#include "dlopen-note.h"
 #include "fd-util.h"
 #include "fileio.h"
 #include "iovec-util.h"
@@ -309,6 +310,8 @@ static int run(int argc, char *argv[]) {
         _cleanup_(pstore_entries_reset) PStoreList list = {};
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         if (argc == 3) {

src/remount-fs/remount-fs.c

@@ -5,6 +5,7 @@
 #include <unistd.h>
 
 #include "alloc-util.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "exit-status.h"
 #include "format-util.h"
@@ -122,6 +123,8 @@ static int run(int argc, char *argv[]) {
         _cleanup_hashmap_free_ Hashmap *pids = NULL;
         int r;
 
+        LIBMOUNT_NOTE(recommended);
+
         log_setup();
 
         if (argc > 1)

src/repart/repart.c

@@ -11614,6 +11614,9 @@ static int run(int argc, char *argv[]) {
         bool node_is_our_loop = false;
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+        TPM2_NOTE(suggested);
+
         log_setup();
 
         r = parse_argv(argc, argv);

src/resolve/resolvectl.c

@@ -20,6 +20,7 @@
 #include "bus-locator.h"
 #include "bus-util.h"
 #include "crypto-util.h"
+#include "dlopen-note.h"
 #include "dns-configuration.h"
 #include "dns-domain.h"
 #include "dns-packet.h"
@@ -3792,6 +3793,8 @@ static int run(int argc, char **argv) {
         bool compat = false;
         int r;
 
+        LIBCRYPTO_NOTE(suggested);
+
         setlocale(LC_ALL, "");
         log_setup();
 

src/resolve/resolved.c

@@ -9,6 +9,7 @@
 #include "bus-object.h"
 #include "capability-util.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "label-util.h"
 #include "log.h"
 #include "main-func.h"
@@ -24,6 +25,8 @@ static int run(int argc, char *argv[]) {
         _unused_ _cleanup_(notify_on_cleanup) const char *notify_stop = NULL;
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         r = service_parse_argv("systemd-resolved.service",

src/shutdown/shutdown.c

@@ -24,6 +24,7 @@
 #include "detach-loopback.h"
 #include "detach-md.h"
 #include "detach-swap.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "exec-util.h"
 #include "fd-util.h"
@@ -378,6 +379,8 @@ int main(int argc, char *argv[]) {
         size_t n_luo_fds = 0;
         int cmd, r;
 
+        LIBSELINUX_NOTE(recommended);
+
         /* LUO will preserve these across kexec */
         dual_timestamp_now(&shutdown_late_start);
 

src/socket-activate/socket-activate.c

@@ -9,6 +9,7 @@
 #include "alloc-util.h"
 #include "build.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "errno-util.h"
 #include "escape.h"
@@ -468,6 +469,8 @@ static int run(int argc, char **argv) {
         _cleanup_strv_free_ char **exec_argv = NULL;
         int r, n;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         char **args = NULL;

src/ssh-generator/ssh-generator.c

@@ -4,6 +4,7 @@
 
 #include "alloc-util.h"
 #include "creds-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -450,6 +451,9 @@ static int run(const char *dest, const char *dest_early, const char *dest_late)
 
         assert(dest);
 
+        LIBCRYPTO_NOTE(suggested);
+        TPM2_NOTE(suggested);
+
         r = proc_cmdline_parse(parse_proc_cmdline_item, /* userdata= */ NULL, /* flags= */ 0);
         if (r < 0)
                 log_warning_errno(r, "Failed to parse kernel command line, ignoring: %m");

src/sysext/sysext.c

@@ -28,6 +28,7 @@
 #include "devnum-util.h"
 #include "discover-image.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "errno-util.h"
 #include "escape.h"
@@ -3175,6 +3176,9 @@ static int run(int argc, char *argv[]) {
         char **args = NULL;
         int r;
 
+        LIBCRYPTO_NOTE(suggested);
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         arg_image_class = invoked_as(argv, "systemd-confext") ? IMAGE_CONFEXT : IMAGE_SYSEXT;

src/sysinstall/sysinstall.c

@@ -15,6 +15,7 @@
 #include "chase.h"
 #include "conf-files.h"
 #include "constants.h"
+#include "dlopen-note.h"
 #include "efi-loader.h"
 #include "efivars.h"
 #include "env-file.h"
@@ -2068,6 +2069,11 @@ static void end_marker(void) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+
         setlocale(LC_ALL, "");
 
         r = parse_argv(argc, argv);

src/systemctl/systemctl-main.c

@@ -3,6 +3,7 @@
 #include <locale.h>
 
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "glyph-util.h"
 #include "log.h"
 #include "logs-show.h"
@@ -23,6 +24,13 @@ static int run(int argc, char *argv[]) {
         char **args = STRV_EMPTY;
         int r;
 
+        COMPRESS_DEFAULT_NOTE;
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         setlocale(LC_ALL, "");
         log_setup();
 

src/sysupdate/sysupdate.c

@@ -14,6 +14,7 @@
 #include "constants.h"
 #include "discover-image.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "errno-util.h"
 #include "fd-util.h"
@@ -2685,6 +2686,11 @@ static int vl_server(void) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTO_NOTE(suggested);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+
         log_setup();
 
         char **args = NULL;

src/sysusers/sysusers.c

@@ -11,6 +11,7 @@
 #include "copy.h"
 #include "creds-util.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "extract-word.h"
 #include "fd-util.h"
@@ -2269,6 +2270,14 @@ static int run(int argc, char *argv[]) {
         Item *i;
         int r;
 
+        LIBAUDIT_NOTE(recommended);
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPT_NOTE(recommended);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBCRYPTO_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         char **args = NULL;
         r = parse_argv(argc, argv, &args);
         if (r <= 0)

src/timedate/timedated.c

@@ -25,6 +25,7 @@
 #include "conf-files.h"
 #include "constants.h"
 #include "daemon-util.h"
+#include "dlopen-note.h"
 #include "extract-word.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -1164,6 +1165,8 @@ static int run(int argc, char *argv[]) {
         _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         r = service_parse_argv("systemd-timedated.service",

src/tmpfiles/tmpfiles.c

@@ -25,6 +25,7 @@
 #include "devnum-util.h"
 #include "dirent-util.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "errno-util.h"
 #include "escape.h"
@@ -4853,6 +4854,12 @@ static int run(int argc, char *argv[]) {
         } phase;
         int r;
 
+        LIBBLKID_NOTE(recommended);
+        LIBCRYPTSETUP_NOTE(suggested);
+        LIBCRYPTO_NOTE(suggested);
+        LIBMOUNT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         char **args = NULL;
         r = parse_argv(argc, argv, &args);
         if (r <= 0)

src/tpm2-setup/tpm2-clear.c

@@ -4,6 +4,7 @@
 
 #include "alloc-util.h"
 #include "build.h"
+#include "dlopen-note.h"
 #include "env-util.h"
 #include "fileio.h"
 #include "format-table.h"
@@ -110,6 +111,10 @@ static int request_tpm2_clear(void) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBTSS2_ESYS_NOTE(suggested);
+        LIBTSS2_MU_NOTE(suggested);
+        LIBTSS2_RC_NOTE(suggested);
+
         log_setup();
 
         r = parse_argv(argc, argv);

src/tpm2-setup/tpm2-generator.c

@@ -2,6 +2,7 @@
 
 #include <unistd.h>
 
+#include "dlopen-note.h"
 #include "dropin.h"
 #include "efivars.h"
 #include "generator.h"
@@ -169,6 +170,10 @@ static int run(const char *dest, const char *dest_early, const char *dest_late)
 
         assert_se(arg_dest = dest);
 
+        LIBTSS2_ESYS_NOTE(suggested);
+        LIBTSS2_MU_NOTE(suggested);
+        LIBTSS2_RC_NOTE(suggested);
+
         r = proc_cmdline_parse(parse_proc_cmdline_item, NULL, PROC_CMDLINE_STRIP_RD_PREFIX);
         if (r < 0)
                 log_warning_errno(r, "Failed to parse kernel command line, ignoring: %m");

src/tpm2-setup/tpm2-setup.c

@@ -10,6 +10,7 @@
 #include "conf-files.h"
 #include "constants.h"
 #include "crypto-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -599,6 +600,8 @@ static int run(int argc, char *argv[]) {
                 return EXIT_SUCCESS;
         }
 
+        LIBBLKID_NOTE(recommended);
+
         r = DLOPEN_LIBCRYPTO(LOG_ERR, required);
         if (r < 0)
                 return r;

src/tpm2-setup/tpm2-swtpm.c

@@ -6,6 +6,7 @@
 
 #include "alloc-util.h"
 #include "chase.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "escape.h"
 #include "fd-util.h"
@@ -145,6 +146,8 @@ static int setup_swtpm(const char *state_dir, int state_fd, const char *secret)
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBBLKID_NOTE(recommended);
+
         log_setup();
 
         _cleanup_free_ char *runtime_dir = NULL;

src/tty-ask-password-agent/tty-ask-password-agent.c

@@ -19,6 +19,7 @@
 #include "daemon-util.h"
 #include "devnum-util.h"
 #include "dirent-util.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "exit-status.h"
 #include "fd-util.h"
@@ -700,6 +701,8 @@ static int ask_on_consoles(char *argv[]) {
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         umask(0022);

src/udev/udevadm.c

@@ -3,6 +3,7 @@
 #include <stdio.h>
 
 #include "argv-util.h"
+#include "dlopen-note.h"
 #include "format-table.h"
 #include "help-util.h"
 #include "label-util.h"
@@ -101,6 +102,10 @@ static int run(int argc, char *argv[]) {
         char **args = NULL;
         int r;
 
+        LIBAPPARMOR_NOTE(recommended);
+        LIBAUDIT_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         if (invoked_as(argv, "udevd"))
                 return run_udevd(argc, argv);
 

src/update-done/update-done.c

@@ -5,6 +5,7 @@
 #include "alloc-util.h"
 #include "build.h"
 #include "chase.h"
+#include "dlopen-note.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -124,6 +125,8 @@ static int run(int argc, char *argv[]) {
         struct stat st;
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         r = parse_argv(argc, argv);
         if (r <= 0)
                 return r;

src/update-utmp/update-utmp.c

@@ -7,6 +7,7 @@
 #include "bus-error.h"
 #include "bus-locator.h"
 #include "bus-util.h"
+#include "dlopen-note.h"
 #include "libaudit-util.h"
 #include "log.h"
 #include "main-func.h"
@@ -109,6 +110,8 @@ static int run(int argc, char *argv[]) {
                 .audit_fd = -EBADF,
         };
 
+        LIBAUDIT_NOTE(recommended);
+
         log_setup();
 
         umask(0022);

src/user-sessions/user-sessions.c

@@ -2,6 +2,7 @@
 
 #include <sys/stat.h>
 
+#include "dlopen-note.h"
 #include "fs-util.h"
 #include "label-util.h"
 #include "log.h"
@@ -12,6 +13,8 @@
 static int run(int argc, char *argv[]) {
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         if (argc != 2)
                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
                                        "This program requires one argument.");

src/userdb/userdbctl.c

@@ -10,6 +10,7 @@
 #include "copy.h"
 #include "creds-util.h"
 #include "dirent-util.h"
+#include "dlopen-note.h"
 #include "errno-list.h"
 #include "errno-util.h"
 #include "escape.h"
@@ -1853,6 +1854,8 @@ static int run(int argc, char *argv[]) {
         _cleanup_strv_free_ char **args = NULL;
         int r;
 
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         r = parse_argv(argc, argv, &args);

src/veritysetup/veritysetup.c

@@ -8,6 +8,7 @@
 #include "alloc-util.h"
 #include "argv-util.h"
 #include "cryptsetup-util.h"
+#include "dlopen-note.h"
 #include "extract-word.h"
 #include "fileio.h"
 #include "format-table.h"
@@ -493,6 +494,8 @@ static int run(int argc, char *argv[]) {
 
         log_setup();
 
+        LIBCRYPTO_NOTE(suggested);
+
         r = DLOPEN_CRYPTSETUP(LOG_ERR, required);
         if (r < 0)
                 return r;

src/vmspawn/vmspawn.c

@@ -29,6 +29,7 @@
 #include "copy.h"
 #include "discover-image.h"
 #include "dissect-image.h"
+#include "dlopen-note.h"
 #include "escape.h"
 #include "ether-addr-util.h"
 #include "event-util.h"
@@ -4286,6 +4287,9 @@ static int run(int argc, char *argv[]) {
         int r, kvm_device_fd = -EBADF, vhost_device_fd = -EBADF;
         _cleanup_strv_free_ char **names = NULL;
 
+        LIBBLKID_NOTE(recommended);
+        LIBSELINUX_NOTE(recommended);
+
         log_setup();
 
         arg_runtime_scope = getuid() == 0 ? RUNTIME_SCOPE_SYSTEM : RUNTIME_SCOPE_USER;

src/volatile-root/volatile-root.c

@@ -7,6 +7,7 @@
 #include "blockdev-util.h"
 #include "chase.h"
 #include "devnum-util.h"
+#include "dlopen-note.h"
 #include "escape.h"
 #include "log.h"
 #include "main-func.h"
@@ -122,6 +123,8 @@ static int run(int argc, char *argv[]) {
         dev_t devt;
         int r;
 
+        LIBMOUNT_NOTE(recommended);
+
         log_setup();
 
         if (argc > 3)