lsm-util: move detection of support of LSMs into a new lsm-util.[ch] helper

This makes the bpf LSM check generic, so that we can use it elsewhere.
it also drops the caching inside it, given that bpf-lsm code in PID1
will cache it a second time a stack frame further up when it checks for
various other bpf functionality.

src/shared/lsm-util.c

@@ -0,0 +1,33 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+
+#include "alloc-util.h"
+#include "extract-word.h"
+#include "fileio.h"
+#include "lsm-util.h"
+#include "string-util.h"
+
+int lsm_supported(const char *name) {
+        _cleanup_free_ char *lsm_list = NULL;
+        int r;
+
+        assert(name);
+
+        r = read_one_line_file("/sys/kernel/security/lsm", &lsm_list);
+        if (r == -ENOENT) /* LSM support not available at all? */
+                return false;
+        if (r < 0)
+                return log_debug_errno(r, "Failed to read /sys/kernel/security/lsm: %m");
+
+        for (const char *p = lsm_list;;) {
+                _cleanup_free_ char *word = NULL;
+
+                r = extract_first_word(&p, &word, ",", 0);
+                if (r == 0)
+                        return false;
+                if (r < 0)
+                        return log_debug_errno(r, "Failed to parse /sys/kernel/security/lsm: %m");
+
+                if (streq(word, name))
+                        return true;
+        }
+}

src/shared/lsm-util.h

@@ -0,0 +1,4 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+int lsm_supported(const char *name);

src/shared/meson.build

@@ -105,6 +105,7 @@ shared_sources = files(
         'logs-show.c',
         'loop-util.c',
         'loopback-setup.c',
+        'lsm-util.c',
         'machine-id-setup.c',
         'machine-pool.c',
         'macvlan-util.c',