SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

dlopen-note: move all dlopen notes to dlopen-note.h

Browse Source 
This also switches all these notes to be defined via SD_ELF_NOTE_DLOPEN_ANCHORED().
Consequently, any notes added within unreachable or unused functions will be
automatically garbage-collected by the linker (--gc-sections) instead of
bloating the final binary.

E.g. unused p11-kit library dependency is now dropped from
systemd-repart.standalone binary.

Before:
```
$ systemd-analyze dlopen-metadata build/systemd-repart.standalone
FEATURE    DESCRIPTION                                                SONAME                        PRIORITY
cryptsetup Support for disk encryption, integrity, and authentication libcryptsetup.so.12           recommended
blkid      Support for block device identification                    libblkid.so.1                 required
libcrypto  Support for cryptographic operations                       libcrypto.so.4 libcrypto.so.3 recommended
mount      Support for mount enumeration                              libmount.so.1                 required
fdisk      Support for reading and writing partition tables           libfdisk.so.1                 required
blkid      Support for block device identification                    libblkid.so.1                 recommended
libcrypto  Support for cryptographic operations                       libcrypto.so.4 libcrypto.so.3 suggested
cryptsetup Support for disk encryption, integrity, and authentication libcryptsetup.so.12           suggested
fdisk      Support for reading and writing partition tables           libfdisk.so.1                 suggested
idn        Support for internationalized domain names                 libidn2.so.0                  suggested
mount      Support for mount enumeration                              libmount.so.1                 recommended
selinux    Support for SELinux                                        libselinux.so.1               recommended
tpm        Support for TPM                                            libtss2-esys.so.0             suggested
tpm        Support for TPM                                            libtss2-rc.so.0               suggested
tpm        Support for TPM                                            libtss2-mu.so.0               suggested
tpm        Support for TPM                                            libtss2-tcti-device.so.0      suggested
p11-kit    Support for PKCS11 hardware tokens                         libp11-kit.so.0               suggested
```

After:
```
$ systemd-analyze dlopen-metadata build/systemd-repart.standalone
FEATURE    DESCRIPTION                                                SONAME                        PRIORITY
cryptsetup Support for disk encryption, integrity, and authentication libcryptsetup.so.12           recommended
blkid      Support for block device identification                    libblkid.so.1                 required
libcrypto  Support for cryptographic operations                       libcrypto.so.4 libcrypto.so.3 recommended
mount      Support for mount enumeration                              libmount.so.1                 required
fdisk      Support for reading and writing partition tables           libfdisk.so.1                 required
blkid      Support for block device identification                    libblkid.so.1                 recommended
libcrypto  Support for cryptographic operations                       libcrypto.so.4 libcrypto.so.3 suggested
cryptsetup Support for disk encryption, integrity, and authentication libcryptsetup.so.12           suggested
fdisk      Support for reading and writing partition tables           libfdisk.so.1                 suggested
mount      Support for mount enumeration                              libmount.so.1                 recommended
selinux    Support for SELinux                                        libselinux.so.1               recommended
tpm        Support for TPM                                            libtss2-esys.so.0             suggested
tpm        Support for TPM                                            libtss2-rc.so.0               suggested
tpm        Support for TPM                                            libtss2-mu.so.0               suggested
tpm        Support for TPM                                            libtss2-tcti-device.so.0      suggested
```
This commit is contained in:
Yu Watanabe
2026-07-10 16:34:26 +09:00
parent aa0db003cf
commit a74b3e1778
114 changed files with 772 additions and 575 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/bpf-bind-iface.c
+1 -1
View File
@@ -31,7 +31,7 @@ int bpf_bind_network_interface_supported(void) {
if (supported >= 0)
return supported;
if (DLOPEN_BPF(LOG_WARNING, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED) < 0)
if (DLOPEN_BPF(LOG_WARNING, recommended) < 0)
return (supported = false);
obj = bind_iface_bpf__open();
src/core/bpf-restrict-fs.c
+1 -1
View File
@@ -78,7 +78,7 @@ bool bpf_restrict_fs_supported(bool initialize) {
if (!initialize)
return false;
if (DLOPEN_BPF(LOG_WARNING, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED) < 0)
if (DLOPEN_BPF(LOG_WARNING, recommended) < 0)
return (supported = false);
r = lsm_supported("bpf");
src/core/bpf-restrict-fsaccess.c
+2 -2
View File
@@ -171,7 +171,7 @@ bool bpf_restrict_fsaccess_supported(void) {
if (supported >= 0)
return supported;
if (DLOPEN_BPF(LOG_WARNING, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED) < 0)
if (DLOPEN_BPF(LOG_WARNING, recommended) < 0)
return (supported = false);
r = lsm_supported("bpf");
@@ -340,7 +340,7 @@ static int restrict_fsaccess_validate_deserialized_fds(Manager *m) {
assert(m);
r = DLOPEN_BPF(LOG_WARNING, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED);
r = DLOPEN_BPF(LOG_WARNING, recommended);
if (r < 0)
return log_error_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"bpf-restrict-fsaccess: Failed to load libbpf for FD validation, aborting.");
src/core/bpf-restrict-ifaces.c
+1 -1
View File
@@ -86,7 +86,7 @@ int bpf_restrict_ifaces_supported(void) {
if (supported >= 0)
return supported;
if (DLOPEN_BPF(LOG_WARNING, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED) < 0)
if (DLOPEN_BPF(LOG_WARNING, recommended) < 0)
return (supported = false);
r = prepare_restrict_ifaces_bpf(NULL, true, NULL, &obj);
src/core/bpf-socket-bind.c
+1 -1
View File
@@ -125,7 +125,7 @@ int bpf_socket_bind_supported(void) {
_cleanup_(socket_bind_bpf_freep) struct socket_bind_bpf *obj = NULL;
int r;
if (DLOPEN_BPF(LOG_WARNING, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED) < 0)
if (DLOPEN_BPF(LOG_WARNING, recommended) < 0)
return false;
r = prepare_socket_bind_bpf(/* unit= */ NULL, /* allow_rules= */ NULL, /* deny_rules= */ NULL, &obj);
src/core/exec-invoke.c
+8 -8
View File
@@ -1310,7 +1310,7 @@ static int setup_pam(
* parent process will exec() the actual daemon. We do things this way to ensure that the main PID of
* the daemon is the one we initially fork()ed. */
r = DLOPEN_LIBPAM(LOG_ERR, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED);
r = DLOPEN_LIBPAM(LOG_ERR, recommended);
if (r < 0)
return r;
@@ -1576,7 +1576,7 @@ static bool seccomp_allows_drop_privileges(const ExecContext *c) {
assert(c);
/* No libseccomp, all is fine */
if (DLOPEN_LIBSECCOMP(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED) < 0)
if (DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended) < 0)
return true;
/* No syscall filter, we are allowed to drop privileges */
@@ -1886,7 +1886,7 @@ static int apply_restrict_filesystems(const ExecContext *c, const ExecParameters
}
/* We are in a new binary, so dl-open again */
r = DLOPEN_BPF(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED);
r = DLOPEN_BPF(LOG_DEBUG, recommended);
if (r < 0)
return r;
@@ -6000,12 +6000,12 @@ int exec_invoke(
}
/* Load a bunch of libraries we'll possibly need later, before we turn off dlopen() */
(void) DLOPEN_BPF(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED);
(void) DLOPEN_CRYPTSETUP(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED);
(void) DLOPEN_LIBMOUNT(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED);
(void) DLOPEN_LIBSECCOMP(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED);
(void) DLOPEN_BPF(LOG_DEBUG, recommended);
(void) DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
(void) DLOPEN_LIBMOUNT(LOG_DEBUG, recommended);
(void) DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended);
/* Needed for userspace verity verification fallback */
(void) DLOPEN_LIBCRYPTO(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED);
(void) DLOPEN_LIBCRYPTO(LOG_DEBUG, recommended);
/* Let's now disable further dlopen()ing of libraries, since we are about to do namespace
* shenanigans, and do not want to mix resources from host and namespace */
src/core/execute.c
+3 -3
View File
@@ -1575,7 +1575,7 @@ void exec_context_dump(const ExecContext *c, FILE* f, const char *prefix) {
fputc('~', f);
#if HAVE_SECCOMP
if (DLOPEN_LIBSECCOMP(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED) >= 0) {
if (DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended) >= 0) {
void *id, *val;
bool first = true;
HASHMAP_FOREACH_KEY(val, id, c->syscall_filter) {
@@ -1994,7 +1994,7 @@ char** exec_context_get_syscall_filter(const ExecContext *c) {
assert(c);
#if HAVE_SECCOMP
if (DLOPEN_LIBSECCOMP(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED) < 0)
if (DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended) < 0)
return strv_new(NULL);
void *id, *val;
@@ -2063,7 +2063,7 @@ char** exec_context_get_syscall_log(const ExecContext *c) {
assert(c);
#if HAVE_SECCOMP
if (DLOPEN_LIBSECCOMP(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED) < 0)
if (DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended) < 0)
return strv_new(NULL);
void *id, *val;
src/core/main.c
+1 -1
View File
@@ -3814,7 +3814,7 @@ static int run_systemd(int argc, char *argv[]) {
}
/* Building without libmount is allowed, but if it is compiled in, then we must be able to load it */
r = DLOPEN_LIBMOUNT(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_REQUIRED);
r = DLOPEN_LIBMOUNT(LOG_DEBUG, required);
if (r < 0 && !ERRNO_IS_NEG_NOT_SUPPORTED(r)) {
error_message = "Failed to load libmount.so";
goto finish;
src/core/mount.c
+1 -1
View File
@@ -2407,7 +2407,7 @@ static int mount_test_startable(Unit *u) {
}
static bool mount_supported(void) {
return DLOPEN_LIBMOUNT(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED) >= 0;
return DLOPEN_LIBMOUNT(LOG_DEBUG, recommended) >= 0;
}
static int mount_subsystem_ratelimited(Manager *m) {
src/core/namespace.c
+1 -1
View File
@@ -3986,7 +3986,7 @@ int refresh_extensions_in_namespace(
if (r > 0)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Target namespace is not separate, cannot reload extensions");
(void) DLOPEN_CRYPTSETUP(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED);
(void) DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
extension_dir = path_join(p->private_namespace_dir, "unit-extensions");
if (!extension_dir)
src/core/selinux-setup.c
+1 -1
View File
@@ -17,7 +17,7 @@ int mac_selinux_setup(bool *loaded_policy) {
assert(loaded_policy);
r = DLOPEN_LIBSELINUX(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED);
r = DLOPEN_LIBSELINUX(LOG_DEBUG, recommended);
if (r < 0)
return 0;