dlopen-note: move all dlopen notes to dlopen-note.h

This also switches all these notes to be defined via SD_ELF_NOTE_DLOPEN_ANCHORED(). Consequently, any notes added within unreachable or unused functions will be automatically garbage-collected by the linker (--gc-sections) instead of bloating the final binary. E.g. unused p11-kit library dependency is now dropped from systemd-repart.standalone binary. Before: ``` $ systemd-analyze dlopen-metadata build/systemd-repart.standalone FEATURE DESCRIPTION SONAME PRIORITY cryptsetup Support for disk encryption, integrity, and authentication libcryptsetup.so.12 recommended blkid Support for block device identification libblkid.so.1 required libcrypto Support for cryptographic operations libcrypto.so.4 libcrypto.so.3 recommended mount Support for mount enumeration libmount.so.1 required fdisk Support for reading and writing partition tables libfdisk.so.1 required blkid Support for block device identification libblkid.so.1 recommended libcrypto Support for cryptographic operations libcrypto.so.4 libcrypto.so.3 suggested cryptsetup Support for disk encryption, integrity, and authentication libcryptsetup.so.12 suggested fdisk Support for reading and writing partition tables libfdisk.so.1 suggested idn Support for internationalized domain names libidn2.so.0 suggested mount Support for mount enumeration libmount.so.1 recommended selinux Support for SELinux libselinux.so.1 recommended tpm Support for TPM libtss2-esys.so.0 suggested tpm Support for TPM libtss2-rc.so.0 suggested tpm Support for TPM libtss2-mu.so.0 suggested tpm Support for TPM libtss2-tcti-device.so.0 suggested p11-kit Support for PKCS11 hardware tokens libp11-kit.so.0 suggested ``` After: ``` $ systemd-analyze dlopen-metadata build/systemd-repart.standalone FEATURE DESCRIPTION SONAME PRIORITY cryptsetup Support for disk encryption, integrity, and authentication libcryptsetup.so.12 recommended blkid Support for block device identification libblkid.so.1 required libcrypto Support for cryptographic operations libcrypto.so.4 libcrypto.so.3 recommended mount Support for mount enumeration libmount.so.1 required fdisk Support for reading and writing partition tables libfdisk.so.1 required blkid Support for block device identification libblkid.so.1 recommended libcrypto Support for cryptographic operations libcrypto.so.4 libcrypto.so.3 suggested cryptsetup Support for disk encryption, integrity, and authentication libcryptsetup.so.12 suggested fdisk Support for reading and writing partition tables libfdisk.so.1 suggested mount Support for mount enumeration libmount.so.1 recommended selinux Support for SELinux libselinux.so.1 recommended tpm Support for TPM libtss2-esys.so.0 suggested tpm Support for TPM libtss2-rc.so.0 suggested tpm Support for TPM libtss2-mu.so.0 suggested tpm Support for TPM libtss2-tcti-device.so.0 suggested ```
2026-07-10 16:34:26 +09:00
parent aa0db003cf
commit a74b3e1778
114 changed files with 772 additions and 575 deletions
@@ -1310,7 +1310,7 @@ static int setup_pam(
         * parent process will exec() the actual daemon. We do things this way to ensure that the main PID of
         * the daemon is the one we initially fork()ed. */

-        r = DLOPEN_LIBPAM(LOG_ERR, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED);
+        r = DLOPEN_LIBPAM(LOG_ERR, recommended);
        if (r < 0)
                return r;

@@ -1576,7 +1576,7 @@ static bool seccomp_allows_drop_privileges(const ExecContext *c) {
        assert(c);

        /* No libseccomp, all is fine */
-        if (DLOPEN_LIBSECCOMP(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED) < 0)
+        if (DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended) < 0)
                return true;

        /* No syscall filter, we are allowed to drop privileges */
@@ -1886,7 +1886,7 @@ static int apply_restrict_filesystems(const ExecContext *c, const ExecParameters
        }

        /* We are in a new binary, so dl-open again */
-        r = DLOPEN_BPF(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED);
+        r = DLOPEN_BPF(LOG_DEBUG, recommended);
        if (r < 0)
                return r;

@@ -6000,12 +6000,12 @@ int exec_invoke(
        }

        /* Load a bunch of libraries we'll possibly need later, before we turn off dlopen() */
-        (void) DLOPEN_BPF(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED);
-        (void) DLOPEN_CRYPTSETUP(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED);
-        (void) DLOPEN_LIBMOUNT(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED);
-        (void) DLOPEN_LIBSECCOMP(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED);
+        (void) DLOPEN_BPF(LOG_DEBUG, recommended);
+        (void) DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
+        (void) DLOPEN_LIBMOUNT(LOG_DEBUG, recommended);
+        (void) DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended);
        /* Needed for userspace verity verification fallback */
-        (void) DLOPEN_LIBCRYPTO(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED);
+        (void) DLOPEN_LIBCRYPTO(LOG_DEBUG, recommended);

        /* Let's now disable further dlopen()ing of libraries, since we are about to do namespace
         * shenanigans, and do not want to mix resources from host and namespace */