SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Manage dlopen notes at beginning of execution, and downgrade priorities in shared libraries (#43060)

Browse Source
This commit is contained in:
Zbigniew Jędrzejewski-Szmek
2026-07-19 21:23:47 +02:00
committed by GitHub
parent 0f81431e35 796580518e
commit d751846043
105 changed files with 236 additions and 246 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/analyze/analyze-security.c
+2 -2
View File
@@ -626,7 +626,7 @@ static int assess_system_call_filter(
uint64_t b;
int r;
r = DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended);
r = dlopen_libseccomp(LOG_DEBUG);
if (r < 0) {
*ret_badness = UINT64_MAX;
*ret_description = NULL;
@@ -2604,7 +2604,7 @@ static int get_security_info(Unit *u, ExecContext *c, CGroupContext *g, RuntimeS
info->_umask = c->umask;
#if HAVE_SECCOMP
if (DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended) >= 0) {
if (dlopen_libseccomp(LOG_DEBUG) >= 0) {
SET_FOREACH(key, c->syscall_archs) {
const char *name;
src/analyze/analyze.c
+1
View File
@@ -697,6 +697,7 @@ static int run(int argc, char *argv[]) {
LIBELF_NOTE(suggested);
LIBMOUNT_NOTE(recommended);
LIBPCRE2_NOTE(suggested);
LIBSECCOMP_NOTE(recommended);
LIBSELINUX_NOTE(recommended);
TPM2_NOTE(suggested);
src/basic/compress.c
+3 -3
View File
@@ -304,7 +304,7 @@ int dlopen_xz(int log_level) {
#if HAVE_XZ
static void *lzma_dl = NULL;
LIBLZMA_NOTE(COMPRESSION_PRIORITY_XZ);
LIBLZMA_NOTE(suggested);
return dlopen_many_sym_or_warn(
&lzma_dl,
@@ -325,7 +325,7 @@ int dlopen_lz4(int log_level) {
#if HAVE_LZ4
static void *lz4_dl = NULL;
LIBLZ4_NOTE(COMPRESSION_PRIORITY_LZ4);
LIBLZ4_NOTE(suggested);
return dlopen_many_sym_or_warn(
&lz4_dl,
@@ -355,7 +355,7 @@ int dlopen_zstd(int log_level) {
#if HAVE_ZSTD
static void *zstd_dl = NULL;
LIBZSTD_NOTE(COMPRESSION_PRIORITY_ZSTD);
LIBZSTD_NOTE(suggested);
return dlopen_many_sym_or_warn(
&zstd_dl,
src/bootctl/bootctl-install.c
+1 -1
View File
@@ -1085,7 +1085,7 @@ static int install_secure_boot_auto_enroll(InstallContext *c) {
if (!c->secure_boot_certificate || !c->secure_boot_private_key)
return 0;
r = DLOPEN_LIBCRYPTO(LOG_DEBUG, recommended);
r = dlopen_libcrypto(LOG_DEBUG);
if (r < 0)
return r;
src/bootctl/bootctl.c
+1
View File
@@ -860,6 +860,7 @@ static int run(int argc, char *argv[]) {
int r;
LIBBLKID_NOTE(recommended);
LIBCRYPTO_NOTE(recommended);
LIBCRYPTSETUP_NOTE(suggested);
LIBMOUNT_NOTE(recommended);
LIBTSS2_ESYS_NOTE(suggested);
src/core/bpf-bind-iface.c
+1 -1
View File
@@ -31,7 +31,7 @@ int bpf_bind_network_interface_supported(void) {
if (supported >= 0)
return supported;
if (DLOPEN_BPF(LOG_WARNING, recommended) < 0)
if (dlopen_bpf(LOG_WARNING) < 0)
return (supported = false);
obj = bind_iface_bpf__open();
src/core/bpf-restrict-fs.c
+1 -1
View File
@@ -78,7 +78,7 @@ bool bpf_restrict_fs_supported(bool initialize) {
if (!initialize)
return false;
if (DLOPEN_BPF(LOG_WARNING, recommended) < 0)
if (dlopen_bpf(LOG_WARNING) < 0)
return (supported = false);
r = lsm_supported("bpf");
src/core/bpf-restrict-fsaccess.c
+2 -2
View File
@@ -171,7 +171,7 @@ bool bpf_restrict_fsaccess_supported(void) {
if (supported >= 0)
return supported;
if (DLOPEN_BPF(LOG_WARNING, recommended) < 0)
if (dlopen_bpf(LOG_WARNING) < 0)
return (supported = false);
r = lsm_supported("bpf");
@@ -340,7 +340,7 @@ static int restrict_fsaccess_validate_deserialized_fds(Manager *m) {
assert(m);
r = DLOPEN_BPF(LOG_WARNING, recommended);
r = dlopen_bpf(LOG_WARNING);
if (r < 0)
return log_error_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"bpf-restrict-fsaccess: Failed to load libbpf for FD validation, aborting.");
src/core/bpf-restrict-ifaces.c
+1 -1
View File
@@ -86,7 +86,7 @@ int bpf_restrict_ifaces_supported(void) {
if (supported >= 0)
return supported;
if (DLOPEN_BPF(LOG_WARNING, recommended) < 0)
if (dlopen_bpf(LOG_WARNING) < 0)
return (supported = false);
r = prepare_restrict_ifaces_bpf(NULL, true, NULL, &obj);
src/core/bpf-socket-bind.c
+1 -1
View File
@@ -125,7 +125,7 @@ int bpf_socket_bind_supported(void) {
_cleanup_(socket_bind_bpf_freep) struct socket_bind_bpf *obj = NULL;
int r;
if (DLOPEN_BPF(LOG_WARNING, recommended) < 0)
if (dlopen_bpf(LOG_WARNING) < 0)
return false;
r = prepare_socket_bind_bpf(/* unit= */ NULL, /* allow_rules= */ NULL, /* deny_rules= */ NULL, &obj);
src/core/exec-invoke.c
+8 -8
View File
@@ -1311,7 +1311,7 @@ static int setup_pam(
* parent process will exec() the actual daemon. We do things this way to ensure that the main PID of
* the daemon is the one we initially fork()ed. */
r = DLOPEN_LIBPAM(LOG_ERR, recommended);
r = dlopen_libpam(LOG_ERR);
if (r < 0)
return r;
@@ -1578,7 +1578,7 @@ static bool seccomp_allows_drop_privileges(const ExecContext *c) {
assert(c);
/* No libseccomp, all is fine */
if (DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended) < 0)
if (dlopen_libseccomp(LOG_DEBUG) < 0)
return true;
/* No syscall filter, we are allowed to drop privileges */
@@ -1888,7 +1888,7 @@ static int apply_restrict_filesystems(const ExecContext *c, const ExecParameters
}
/* We are in a new binary, so dl-open again */
r = DLOPEN_BPF(LOG_DEBUG, recommended);
r = dlopen_bpf(LOG_DEBUG);
if (r < 0)
return r;
@@ -6006,12 +6006,12 @@ int exec_invoke(
}
/* Load a bunch of libraries we'll possibly need later, before we turn off dlopen() */
(void) DLOPEN_BPF(LOG_DEBUG, recommended);
(void) DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
(void) DLOPEN_LIBMOUNT(LOG_DEBUG, recommended);
(void) DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended);
(void) dlopen_bpf(LOG_DEBUG);
(void) dlopen_cryptsetup(LOG_DEBUG);
(void) dlopen_libmount(LOG_DEBUG);
(void) dlopen_libseccomp(LOG_DEBUG);
/* Needed for userspace verity verification fallback */
(void) DLOPEN_LIBCRYPTO(LOG_DEBUG, recommended);
(void) dlopen_libcrypto(LOG_DEBUG);
/* Let's now disable further dlopen()ing of libraries, since we are about to do namespace
* shenanigans, and do not want to mix resources from host and namespace */
src/core/execute.c
+3 -3
View File
@@ -1575,7 +1575,7 @@ void exec_context_dump(const ExecContext *c, FILE* f, const char *prefix) {
fputc('~', f);
#if HAVE_SECCOMP
if (DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended) >= 0) {
if (dlopen_libseccomp(LOG_DEBUG) >= 0) {
void *id, *val;
bool first = true;
HASHMAP_FOREACH_KEY(val, id, c->syscall_filter) {
@@ -1996,7 +1996,7 @@ char** exec_context_get_syscall_filter(const ExecContext *c) {
assert(c);
#if HAVE_SECCOMP
if (DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended) < 0)
if (dlopen_libseccomp(LOG_DEBUG) < 0)
return strv_new(NULL);
void *id, *val;
@@ -2065,7 +2065,7 @@ char** exec_context_get_syscall_log(const ExecContext *c) {
assert(c);
#if HAVE_SECCOMP
if (DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended) < 0)
if (dlopen_libseccomp(LOG_DEBUG) < 0)
return strv_new(NULL);
void *id, *val;
src/core/executor.c
+6
View File
@@ -236,6 +236,12 @@ int run_executor(int argc, char *argv[]) {
LIBACL_NOTE(recommended);
LIBAPPARMOR_NOTE(recommended);
LIBBLKID_NOTE(recommended);
LIBBPF_NOTE(recommended);
LIBCRYPTO_NOTE(recommended);
LIBCRYPTSETUP_NOTE(recommended);
LIBMOUNT_NOTE(recommended);
LIBPAM_NOTE(recommended);
LIBSECCOMP_NOTE(recommended);
LIBSELINUX_NOTE(recommended);
TPM2_NOTE(suggested);
src/core/main.c
+3 -1
View File
@@ -3823,7 +3823,7 @@ static int run_systemd(int argc, char *argv[]) {
}
/* Building without libmount is allowed, but if it is compiled in, then we must be able to load it */
r = DLOPEN_LIBMOUNT(LOG_DEBUG, required);
r = dlopen_libmount(LOG_DEBUG);
if (r < 0 && !ERRNO_IS_NEG_NOT_SUPPORTED(r)) {
error_message = "Failed to load libmount.so";
goto finish;
@@ -4035,8 +4035,10 @@ int main(int argc, char *argv[]) {
LIBCRYPTO_NOTE(suggested);
LIBCRYPTSETUP_NOTE(recommended);
LIBKMOD_NOTE(recommended);
LIBMOUNT_NOTE(required);
LIBPCRE2_NOTE(suggested);
LIBSECCOMP_NOTE(recommended);
LIBSELINUX_NOTE(recommended);
TPM2_NOTE(suggested);
#if SYSTEMD_MULTICALL_BINARY
src/core/mount.c
+1 -1
View File
@@ -2407,7 +2407,7 @@ static int mount_test_startable(Unit *u) {
}
static bool mount_supported(void) {
return DLOPEN_LIBMOUNT(LOG_DEBUG, recommended) >= 0;
return dlopen_libmount(LOG_DEBUG) >= 0;
}
static int mount_subsystem_ratelimited(Manager *m) {
src/core/namespace.c
+1 -1
View File
@@ -3986,7 +3986,7 @@ int refresh_extensions_in_namespace(
if (r > 0)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Target namespace is not separate, cannot reload extensions");
(void) DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
(void) dlopen_cryptsetup(LOG_DEBUG);
extension_dir = path_join(p->private_namespace_dir, "unit-extensions");
if (!extension_dir)
src/core/selinux-setup.c
+1 -1
View File
@@ -17,7 +17,7 @@ int mac_selinux_setup(bool *loaded_policy) {
assert(loaded_policy);
r = DLOPEN_LIBSELINUX(LOG_DEBUG, recommended);
r = dlopen_libselinux(LOG_DEBUG);
if (r < 0)
return 0;
src/creds/creds.c
+2 -1
View File
@@ -189,7 +189,7 @@ static int is_tmpfs_with_noswap(dev_t devno) {
_cleanup_(mnt_free_tablep) struct libmnt_table *table = NULL;
int r;
r = DLOPEN_LIBMOUNT(LOG_DEBUG, recommended);
r = dlopen_libmount(LOG_DEBUG);
if (r < 0)
return r;
@@ -1473,6 +1473,7 @@ static int run(int argc, char *argv[]) {
int r;
LIBCRYPTO_NOTE(suggested);
LIBMOUNT_NOTE(recommended);
TPM2_NOTE(suggested);
log_setup();
src/cryptenroll/cryptenroll-varlink.c
+2 -2
View File
@@ -344,7 +344,7 @@ static int vl_method_enroll(
if (FLAGS_SET(flags, SD_VARLINK_METHOD_MORE))
c.link = sd_varlink_ref(link);
r = DLOPEN_CRYPTSETUP(LOG_DEBUG, required);
r = dlopen_cryptsetup(LOG_DEBUG);
if (r < 0)
return r;
@@ -421,7 +421,7 @@ static int vl_method_list_slots(
if (strdup_to(&c.node, node) < 0)
return -ENOMEM;
r = DLOPEN_CRYPTSETUP(LOG_DEBUG, required);
r = dlopen_cryptsetup(LOG_DEBUG);
if (r < 0)
return r;
src/cryptenroll/cryptenroll.c
+2 -1
View File
@@ -1257,6 +1257,7 @@ static int run(int argc, char *argv[]) {
int slot, r;
LIBCRYPTO_NOTE(suggested);
LIBCRYPTSETUP_NOTE(required);
LIBFIDO2_NOTE(suggested);
LIBP11KIT_NOTE(suggested);
LIBQRENCODE_NOTE(suggested);
@@ -1282,7 +1283,7 @@ static int run(int argc, char *argv[]) {
if (r <= 0)
return r;
r = DLOPEN_CRYPTSETUP(LOG_ERR, required);
r = dlopen_cryptsetup(LOG_ERR);
if (r < 0)
return r;
src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-fido2.c
+4 -3
View File
@@ -19,6 +19,7 @@
/* for libcryptsetup debug purpose */
_public_ const char* cryptsetup_token_version(void) {
LIBCRYPTSETUP_NOTE(required);
LIBFIDO2_NOTE(suggested);
return TOKEN_VERSION_MAJOR "." TOKEN_VERSION_MINOR " systemd-v" PROJECT_VERSION_FULL " (" GIT_VERSION ")";
@@ -40,7 +41,7 @@ _public_ int cryptsetup_token_open_pin(
assert(pin || pin_size == 0);
assert(token >= 0);
r = DLOPEN_CRYPTSETUP(LOG_DEBUG, required);
r = dlopen_cryptsetup(LOG_DEBUG);
if (r < 0)
return r;
@@ -105,7 +106,7 @@ _public_ void cryptsetup_token_dump(
assert(json);
if (DLOPEN_CRYPTSETUP(LOG_DEBUG, required) < 0)
if (dlopen_cryptsetup(LOG_DEBUG) < 0)
return;
r = parse_luks2_fido2_data(cd, json, &rp_id, &salt, &salt_size, &cid, &cid_size, &required);
@@ -172,7 +173,7 @@ _public_ int cryptsetup_token_validate(
assert(json);
r = DLOPEN_CRYPTSETUP(LOG_DEBUG, required);
r = dlopen_cryptsetup(LOG_DEBUG);
if (r < 0)
return r;
src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-pkcs11.c
+4 -3
View File
@@ -20,6 +20,7 @@
/* for libcryptsetup debug purpose */
_public_ const char* cryptsetup_token_version(void) {
LIBCRYPTO_NOTE(suggested);
LIBCRYPTSETUP_NOTE(required);
LIBP11KIT_NOTE(suggested);
return TOKEN_VERSION_MAJOR "." TOKEN_VERSION_MINOR " systemd-v" PROJECT_VERSION_FULL " (" GIT_VERSION ")";
@@ -40,7 +41,7 @@ _public_ int cryptsetup_token_open_pin(
assert(pin || pin_size == 0);
assert(token >= 0);
r = DLOPEN_CRYPTSETUP(LOG_DEBUG, required);
r = dlopen_cryptsetup(LOG_DEBUG);
if (r < 0)
return r;
@@ -98,7 +99,7 @@ _public_ void cryptsetup_token_dump(
_cleanup_free_ void *pkcs11_key = NULL;
Pkcs11RsaPadding rsa_padding = PKCS11_RSA_PADDING_PKCS1V15;
if (DLOPEN_CRYPTSETUP(LOG_DEBUG, required) < 0)
if (dlopen_cryptsetup(LOG_DEBUG) < 0)
return;
r = parse_luks2_pkcs11_data(cd, json, &pkcs11_uri, &pkcs11_key, &pkcs11_key_size, &rsa_padding);
@@ -128,7 +129,7 @@ _public_ int cryptsetup_token_validate(
sd_json_variant *w;
_cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL;
r = DLOPEN_CRYPTSETUP(LOG_DEBUG, required);
r = dlopen_cryptsetup(LOG_DEBUG);
if (r < 0)
return r;
src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c
+4 -3
View File
@@ -21,6 +21,7 @@
/* for libcryptsetup debug purpose */
_public_ const char* cryptsetup_token_version(void) {
LIBCRYPTO_NOTE(suggested);
LIBCRYPTSETUP_NOTE(required);
TPM2_NOTE(suggested);
return TOKEN_VERSION_MAJOR "." TOKEN_VERSION_MINOR " systemd-v" PROJECT_VERSION_FULL " (" GIT_VERSION ")";
@@ -73,7 +74,7 @@ _public_ int cryptsetup_token_open_pin(
assert(ret_password);
assert(ret_password_len);
r = DLOPEN_CRYPTSETUP(LOG_DEBUG, required);
r = dlopen_cryptsetup(LOG_DEBUG);
if (r < 0)
return r;
@@ -217,7 +218,7 @@ _public_ void cryptsetup_token_dump(
assert(json);
if (DLOPEN_CRYPTSETUP(LOG_DEBUG, required) < 0)
if (dlopen_cryptsetup(LOG_DEBUG) < 0)
return;
r = sd_json_parse(json, SD_JSON_PARSE_MUST_BE_OBJECT, &v, /* reterr_line= */ NULL, /* reterr_column= */ NULL);
@@ -313,7 +314,7 @@ _public_ int cryptsetup_token_validate(
assert(json);
r = DLOPEN_CRYPTSETUP(LOG_DEBUG, required);
r = dlopen_cryptsetup(LOG_DEBUG);
if (r < 0)
return r;
src/cryptsetup/cryptsetup.c
+4 -2
View File
@@ -539,7 +539,7 @@ static int parse_one_option(const char *option) {
#if HAVE_OPENSSL
_cleanup_strv_free_ char **l = NULL;
r = DLOPEN_LIBCRYPTO(LOG_ERR, recommended);
r = dlopen_libcrypto(LOG_ERR);
if (r < 0)
return r;
@@ -2885,6 +2885,8 @@ static int run(int argc, char *argv[]) {
int r;
LIBBLKID_NOTE(recommended);
LIBCRYPTO_NOTE(recommended);
LIBCRYPTSETUP_NOTE(required);
LIBFIDO2_NOTE(suggested);
LIBMOUNT_NOTE(recommended);
LIBP11KIT_NOTE(suggested);
@@ -2899,7 +2901,7 @@ static int run(int argc, char *argv[]) {
if (r <= 0)
return r;
r = DLOPEN_CRYPTSETUP(LOG_ERR, required);
r = dlopen_cryptsetup(LOG_ERR);
if (r < 0)
return r;
src/dissect/dissect.c
+2 -1
View File
@@ -494,7 +494,7 @@ static int parse_argv(int argc, char *argv[]) {
break;
OPTION_LONG("make-archive", NULL, "Convert the DDI to an archive file"):
r = DLOPEN_LIBARCHIVE(LOG_ERR, recommended);
r = dlopen_libarchive(LOG_ERR);
if (r < 0)
return r;
@@ -1970,6 +1970,7 @@ static int run(int argc, char *argv[]) {
int r;
LIBACL_NOTE(recommended);
LIBARCHIVE_NOTE(recommended);
LIBBLKID_NOTE(recommended);
LIBCRYPTO_NOTE(suggested);
LIBCRYPTSETUP_NOTE(suggested);
src/growfs/growfs.c
+2 -1
View File
@@ -34,7 +34,7 @@ static int resize_crypt_luks_device(dev_t devno, const char *fstype, dev_t main_
uint64_t size;
int r;
r = DLOPEN_CRYPTSETUP(LOG_WARNING, recommended);
r = dlopen_cryptsetup(LOG_WARNING);
if (r < 0)
return r;
@@ -194,6 +194,7 @@ static int run(int argc, char *argv[]) {
int r;
LIBBLKID_NOTE(recommended);
LIBCRYPTSETUP_NOTE(recommended);
log_setup();
src/home/homectl.c
+2 -1
View File
@@ -2502,7 +2502,7 @@ static int verb_list_signing_keys(int argc, char *argv[], uintptr_t _data, void
/* Let's decode the PEM key to DER (so that we lose prefix/suffix), then truncate it
* for display reasons. */
r = DLOPEN_LIBCRYPTO(LOG_DEBUG, recommended);
r = dlopen_libcrypto(LOG_DEBUG);
if (r < 0)
return r;
@@ -5185,6 +5185,7 @@ static int run(int argc, char *argv[]) {
int r;
LIBCRYPT_NOTE(recommended);
LIBCRYPTO_NOTE(recommended);
LIBFIDO2_NOTE(suggested);
LIBP11KIT_NOTE(suggested);
LIBQRENCODE_NOTE(suggested);
src/home/homed-manager.c
+1 -1
View File
@@ -1545,7 +1545,7 @@ int manager_startup(Manager *m) {
assert(m);
r = DLOPEN_LIBCRYPTO(LOG_ERR, required);
r = dlopen_libcrypto(LOG_ERR);
if (r < 0)
return r;
src/home/homed.c
+1
View File
@@ -20,6 +20,7 @@ static int run(int argc, char *argv[]) {
int r;
LIBCRYPT_NOTE(recommended);
LIBCRYPTO_NOTE(required);
PASSWORD_NOTE(suggested);
log_setup();
src/home/homework-fscrypt.c
+4 -4
View File
@@ -232,7 +232,7 @@ static int fscrypt_slot_try_v1(
assert(encrypted_size > 0);
assert(match_key_descriptor);
r = DLOPEN_LIBCRYPTO(LOG_ERR, recommended);
r = dlopen_libcrypto(LOG_ERR);
if (r < 0)
return r;
@@ -331,7 +331,7 @@ static int fscrypt_slot_try_v2(
assert(iovec_is_set(tag));
assert(match_key_descriptor);
r = DLOPEN_LIBCRYPTO(LOG_ERR, recommended);
r = dlopen_libcrypto(LOG_ERR);
if (r < 0)
return r;
@@ -700,7 +700,7 @@ static int fscrypt_slot_set(
size_t encrypted_size;
ssize_t ss;
r = DLOPEN_LIBCRYPTO(LOG_ERR, recommended);
r = dlopen_libcrypto(LOG_ERR);
if (r < 0)
return r;
@@ -813,7 +813,7 @@ int home_create_fscrypt(
assert(setup);
assert(ret_home);
r = DLOPEN_LIBCRYPTO(LOG_ERR, recommended);
r = dlopen_libcrypto(LOG_ERR);
if (r < 0)
return r;
src/home/homework-luks.c
+11 -11
View File
@@ -146,7 +146,7 @@ static int probe_file_system_by_fd(
assert(ret_fstype);
assert(ret_uuid);
r = DLOPEN_LIBBLKID(LOG_DEBUG, recommended);
r = dlopen_libblkid(LOG_DEBUG);
if (r < 0)
return r;
@@ -529,7 +529,7 @@ static int acquire_open_luks_device(
assert(setup);
assert(!setup->crypt_device);
r = DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
r = dlopen_cryptsetup(LOG_DEBUG);
if (r < 0)
return r;
@@ -684,7 +684,7 @@ static int luks_validate(
assert(ret_size);
assert(sector_size > 0);
r = DLOPEN_LIBBLKID(LOG_DEBUG, recommended);
r = dlopen_libblkid(LOG_DEBUG);
if (r < 0)
return r;
@@ -805,7 +805,7 @@ static int crypt_device_to_evp_cipher(struct crypt_device *cd, const EVP_CIPHER
assert(cd);
assert(ret);
r = DLOPEN_LIBCRYPTO(LOG_ERR, recommended);
r = dlopen_libcrypto(LOG_ERR);
if (r < 0)
return r;
@@ -1293,7 +1293,7 @@ int home_setup_luks(
assert(setup);
assert(user_record_storage(h) == USER_LUKS);
r = DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
r = dlopen_cryptsetup(LOG_DEBUG);
if (r < 0)
return r;
@@ -1594,7 +1594,7 @@ int home_activate_luks(
assert(setup);
assert(ret_home);
r = DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
r = dlopen_cryptsetup(LOG_DEBUG);
if (r < 0)
return r;
@@ -2211,11 +2211,11 @@ int home_create_luks(
assert(setup->image_fd < 0);
assert(ret_home);
r = DLOPEN_FDISK(LOG_DEBUG, recommended);
r = dlopen_fdisk(LOG_DEBUG);
if (r < 0)
return r;
r = DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
r = dlopen_cryptsetup(LOG_DEBUG);
if (r < 0)
return r;
@@ -3250,11 +3250,11 @@ int home_resize_luks(
assert(user_record_storage(h) == USER_LUKS);
assert(setup);
r = DLOPEN_FDISK(LOG_DEBUG, recommended);
r = dlopen_fdisk(LOG_DEBUG);
if (r < 0)
return r;
r = DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
r = dlopen_cryptsetup(LOG_DEBUG);
if (r < 0)
return r;
@@ -3712,7 +3712,7 @@ int home_passwd_luks(
assert(user_record_storage(h) == USER_LUKS);
assert(setup);
r = DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
r = dlopen_cryptsetup(LOG_DEBUG);
if (r < 0)
return r;
src/home/homework.c
+5 -1
View File
@@ -1329,7 +1329,7 @@ static int determine_default_storage(UserStorage *ret) {
if (r < 0)
log_warning_errno(r, "Failed to determine if %s is encrypted, ignoring: %m", get_home_root());
r = DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
r = dlopen_cryptsetup(LOG_DEBUG);
if (r < 0)
log_info("Not using '%s' storage, since libcryptsetup could not be loaded.", user_storage_to_string(USER_LUKS));
else {
@@ -1999,7 +1999,11 @@ static int run(int argc, char *argv[]) {
sd_json_variant *fdmap, *blob_fd_variant;
int r;
LIBBLKID_NOTE(recommended);
LIBCRYPT_NOTE(recommended);
LIBCRYPTO_NOTE(recommended);
LIBCRYPTSETUP_NOTE(recommended);
LIBFDISK_NOTE(recommended);
LIBFIDO2_NOTE(suggested);
LIBMOUNT_NOTE(recommended);
LIBP11KIT_NOTE(suggested);
src/home/pam_systemd_home.c
+7 -5
View File
@@ -6,6 +6,7 @@
#include "bus-common-errors.h"
#include "bus-locator.h"
#include "bus-util.h"
#include "dlopen-note.h"
#include "fd-util.h"
#include "home-util.h"
#include "locale-util.h"
@@ -786,7 +787,8 @@ _public_ PAM_EXTERN int pam_sm_authenticate(
bool debug = false;
int r;
r = DLOPEN_LIBPAM(LOG_DEBUG, required);
LIBPAM_NOTE(required);
r = dlopen_libpam(LOG_DEBUG);
if (r < 0)
return PAM_SERVICE_ERR;
@@ -851,7 +853,7 @@ _public_ PAM_EXTERN int pam_sm_open_session(
bool debug = false;
int r;
r = DLOPEN_LIBPAM(LOG_DEBUG, required);
r = dlopen_libpam(LOG_DEBUG);
if (r < 0)
return PAM_SERVICE_ERR;
@@ -908,7 +910,7 @@ _public_ PAM_EXTERN int pam_sm_close_session(
bool debug = false;
int r;
r = DLOPEN_LIBPAM(LOG_DEBUG, required);
r = dlopen_libpam(LOG_DEBUG);
if (r < 0)
return PAM_SERVICE_ERR;
@@ -973,7 +975,7 @@ _public_ PAM_EXTERN int pam_sm_acct_mgmt(
usec_t t;
int r;
r = DLOPEN_LIBPAM(LOG_DEBUG, required);
r = dlopen_libpam(LOG_DEBUG);
if (r < 0)
return PAM_SERVICE_ERR;
@@ -1092,7 +1094,7 @@ _public_ PAM_EXTERN int pam_sm_chauthtok(
bool debug = false;
int r;
r = DLOPEN_LIBPAM(LOG_DEBUG, required);
r = dlopen_libpam(LOG_DEBUG);
if (r < 0)
return PAM_SERVICE_ERR;
src/imds/imdsd.c
+4 -1
View File
@@ -20,6 +20,7 @@
#include "creds-util.h"
#include "curl-util.h"
#include "device-private.h"
#include "dlopen-note.h"
#include "dns-rr.h"
#include "errno-util.h"
#include "escape.h"
@@ -3047,13 +3048,15 @@ static int parse_proc_cmdline_item(const char *key, const char *value, void *dat
static int run(int argc, char* argv[]) {
int r;
LIBCURL_NOTE(required);
log_setup();
r = parse_argv(argc, argv);
if (r <= 0)
return r;
r = DLOPEN_CURL(LOG_DEBUG, required);
r = dlopen_curl(LOG_DEBUG);
if (r < 0)
return r;
src/import/import-common.c
+2 -2
View File
@@ -31,7 +31,7 @@ int import_fork_tar_x(int tree_fd, int userns_fd, PidRef *ret_pid) {
assert(tree_fd >= 0);
assert(ret_pid);
r = DLOPEN_LIBARCHIVE(LOG_DEBUG, recommended);
r = dlopen_libarchive(LOG_DEBUG);
if (r < 0)
return r;
@@ -99,7 +99,7 @@ int import_fork_tar_c(int tree_fd, int userns_fd, PidRef *ret_pid) {
assert(tree_fd >= 0);
assert(ret_pid);
r = DLOPEN_LIBARCHIVE(LOG_DEBUG, recommended);
r = dlopen_libarchive(LOG_DEBUG);
if (r < 0)
return r;
src/import/pull-job.c
+1 -1
View File
@@ -281,7 +281,7 @@ static int pull_job_open_disk(PullJob *j) {
}
if (j->calc_checksum) {
r = DLOPEN_LIBCRYPTO(LOG_ERR, recommended);
r = dlopen_libcrypto(LOG_ERR);
if (r < 0)
return r;
src/import/pull.c
+1
View File
@@ -610,6 +610,7 @@ static int run(int argc, char *argv[]) {
int r;
ARCHIVE_NOTE(recommended);
LIBCRYPTO_NOTE(recommended);
LIBCURL_NOTE(suggested);
LIBSELINUX_NOTE(recommended);
src/integritysetup/integritysetup.c
+4 -1
View File
@@ -6,6 +6,7 @@
#include "alloc-util.h"
#include "argv-util.h"
#include "cryptsetup-util.h"
#include "dlopen-note.h"
#include "fileio.h"
#include "format-table.h"
#include "help-util.h"
@@ -199,12 +200,14 @@ static int verb_detach(int argc, char *argv[], uintptr_t _data, void *userdata)
static int run(int argc, char *argv[]) {
int r;
LIBCRYPTSETUP_NOTE(required);
if (argv_looks_like_help(argc, argv))
return help();
log_setup();
r = DLOPEN_CRYPTSETUP(LOG_ERR, required);
r = dlopen_cryptsetup(LOG_ERR);
if (r < 0)
return r;
src/journal-remote/journal-gatewayd.c
+2 -1
View File
@@ -1261,6 +1261,7 @@ static int run(int argc, char *argv[]) {
COMPRESS_JOURNAL_NOTE;
LIBGNUTLS_NOTE(suggested);
LIBMICROHTTPD_NOTE(required);
log_setup();
@@ -1268,7 +1269,7 @@ static int run(int argc, char *argv[]) {
if (r <= 0)
return r;
r = DLOPEN_MICROHTTPD(LOG_ERR, required);
r = dlopen_microhttpd(LOG_ERR);
if (r < 0)
return r;
src/journal-remote/journal-remote-main.c
+2 -1
View File
@@ -469,7 +469,7 @@ static int setup_microhttpd_server(RemoteServer *s,
#if HAVE_MICROHTTPD
int r;
r = DLOPEN_MICROHTTPD(LOG_ERR, required);
r = dlopen_microhttpd(LOG_ERR);
if (r < 0)
return r;
@@ -1170,6 +1170,7 @@ static int run(int argc, char **argv) {
COMPRESS_DEFAULT_NOTE;
LIBCRYPTO_NOTE(suggested);
LIBGNUTLS_NOTE(suggested);
LIBMICROHTTPD_NOTE(required);
LIBSELINUX_NOTE(recommended);
log_setup();
src/journal-remote/journal-upload.c
+2 -1
View File
@@ -871,6 +871,7 @@ static int run(int argc, char **argv) {
int r;
COMPRESS_DEFAULT_NOTE;
LIBCURL_NOTE(required);
log_setup();
@@ -882,7 +883,7 @@ static int run(int argc, char **argv) {
if (r <= 0)
return r;
r = DLOPEN_CURL(LOG_DEBUG, required);
r = dlopen_curl(LOG_DEBUG);
if (r < 0)
return r;
src/journal/journalctl-authenticate.c
+1 -1
View File
@@ -70,7 +70,7 @@ int action_setup_keys(void) {
assert(arg_action == ACTION_SETUP_KEYS);
r = DLOPEN_LIBCRYPTO(LOG_ERR, recommended);
r = dlopen_libcrypto(LOG_ERR);
if (r < 0)
return r;
src/journal/journalctl.c
+1
View File
@@ -1035,6 +1035,7 @@ static int run(int argc, char *argv[]) {
COMPRESS_JOURNAL_NOTE;
LIBACL_NOTE(recommended);
LIBBLKID_NOTE(recommended);
LIBCRYPTO_NOTE(recommended);
LIBCRYPTSETUP_NOTE(suggested);
LIBMOUNT_NOTE(recommended);
LIBPCRE2_NOTE(suggested);
src/keyutil/keyutil.c
+4 -1
View File
@@ -4,6 +4,7 @@
#include "ask-password-api.h"
#include "build.h"
#include "crypto-util.h"
#include "dlopen-note.h"
#include "fd-util.h"
#include "fileio.h"
#include "format-table.h"
@@ -233,7 +234,7 @@ static int verb_extract_public(int argc, char *argv[], uintptr_t _data, void *us
return r;
}
r = DLOPEN_LIBCRYPTO(LOG_ERR, required);
r = dlopen_libcrypto(LOG_ERR);
if (r < 0)
return r;
@@ -405,6 +406,8 @@ static int verb_pkcs7(int argc, char *argv[], uintptr_t _data, void *userdata) {
static int run(int argc, char *argv[]) {
int r;
LIBCRYPTO_NOTE(required);
log_setup();
char **args = NULL;
src/login/pam_systemd.c
+3 -2
View File
@@ -1807,7 +1807,8 @@ _public_ PAM_EXTERN int pam_sm_open_session(
assert(pamh);
r = DLOPEN_LIBPAM(LOG_DEBUG, required);
LIBPAM_NOTE(required);
r = dlopen_libpam(LOG_DEBUG);
if (r < 0)
return PAM_SERVICE_ERR;
@@ -1915,7 +1916,7 @@ _public_ PAM_EXTERN int pam_sm_close_session(
assert(pamh);
r = DLOPEN_LIBPAM(LOG_DEBUG, required);
r = dlopen_libpam(LOG_DEBUG);
if (r < 0)
return PAM_SERVICE_ERR;
src/login/pam_systemd_loadkey.c
+2 -1
View File
@@ -19,7 +19,8 @@ _public_ PAM_EXTERN int pam_sm_authenticate(
assert(pamh);
r = DLOPEN_LIBPAM(LOG_DEBUG, required);
LIBPAM_NOTE(required);
r = dlopen_libpam(LOG_DEBUG);
if (r < 0)
return PAM_SERVICE_ERR;
src/measure/measure-tool.c
+3 -2
View File
@@ -179,7 +179,7 @@ static int parse_argv(int argc, char *argv[], char ***ret_args) {
"Select TPM bank (SHA1, SHA256, SHA384, SHA512)"): {
const EVP_MD *implementation;
r = DLOPEN_LIBCRYPTO(LOG_ERR, required);
r = dlopen_libcrypto(LOG_ERR);
if (r < 0)
return r;
@@ -1131,6 +1131,7 @@ static int verb_policy_digest(int argc, char *argv[], uintptr_t _data, void *use
static int run(int argc, char *argv[]) {
int r;
LIBCRYPTO_NOTE(required);
TPM2_NOTE(suggested);
log_setup();
@@ -1140,7 +1141,7 @@ static int run(int argc, char *argv[]) {
if (r <= 0)
return r;
r = DLOPEN_LIBCRYPTO(LOG_ERR, required);
r = dlopen_libcrypto(LOG_ERR);
if (r < 0)
return r;
src/network/networkd-sysctl.c
+2 -1
View File
@@ -108,7 +108,8 @@ int manager_install_sysctl_monitor(Manager *manager) {
assert(manager);
r = DLOPEN_BPF(LOG_DEBUG, recommended);
LIBBPF_NOTE(recommended);
r = dlopen_bpf(LOG_DEBUG);
if (ERRNO_IS_NEG_NOT_SUPPORTED(r))
return log_debug_errno(r, "sysctl monitor disabled, as BPF support is not available.");
if (r < 0)
src/nspawn/nspawn-oci.c
+1 -1
View File
@@ -1826,7 +1826,7 @@ static int oci_seccomp(const char *name, sd_json_variant *v, sd_json_dispatch_fl
if (r < 0)
return json_log(def, flags, r, "Unknown default action: %s", sd_json_variant_string(def));
r = DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended);
r = dlopen_libseccomp(LOG_DEBUG);
if (r < 0)
return json_log(def, flags, r, "No support for libseccomp: %m");
src/nspawn/nspawn.c
+15 -7
View File
@@ -45,6 +45,7 @@
#include "devnum-util.h"
#include "discover-image.h"
#include "dissect-image.h"
#include "dlopen-note.h"
#include "env-util.h"
#include "escape.h"
#include "ether-addr-util.h"
@@ -6148,13 +6149,20 @@ static int run(int argc, char *argv[]) {
if (arg_cleanup)
return do_cleanup();
(void) DLOPEN_CRYPTSETUP(LOG_DEBUG, suggested);
(void) DLOPEN_LIBACL(LOG_DEBUG, recommended);
(void) DLOPEN_LIBBLKID(LOG_DEBUG, recommended);
(void) DLOPEN_LIBCRYPTO(LOG_WARNING, recommended);
(void) DLOPEN_LIBMOUNT(LOG_DEBUG, recommended);
(void) DLOPEN_LIBSECCOMP(LOG_DEBUG, recommended);
(void) DLOPEN_LIBSELINUX(LOG_DEBUG, recommended);
LIBACL_NOTE(recommended);
LIBBLKID_NOTE(recommended);
LIBCRYPTO_NOTE(recommended);
LIBCRYPTSETUP_NOTE(suggested);
LIBMOUNT_NOTE(recommended);
LIBSECCOMP_NOTE(recommended);
LIBSELINUX_NOTE(recommended);
(void) dlopen_cryptsetup(LOG_DEBUG);
(void) dlopen_libacl(LOG_DEBUG);
(void) dlopen_libblkid(LOG_DEBUG);
(void) dlopen_libcrypto(LOG_WARNING);
(void) dlopen_libmount(LOG_DEBUG);
(void) dlopen_libseccomp(LOG_DEBUG);
(void) dlopen_libselinux(LOG_DEBUG);
r = cg_has_legacy();
if (r < 0)
src/nsresourced/userns-restrict.c
+2 -1
View File
@@ -68,7 +68,8 @@ int userns_restrict_install(
if (r == 0)
return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "bpf-lsm not supported, can't lock down user namespace.");
r = DLOPEN_BPF(LOG_DEBUG, recommended);
LIBBPF_NOTE(recommended);
r = dlopen_bpf(LOG_DEBUG);
if (r < 0)
return r;
src/pcrextend/pcrextend.c
+2 -1
View File
@@ -91,7 +91,7 @@ static int parse_argv(int argc, char *argv[], char ***ret_args) {
OPTION_LONG("bank", "DIGEST", "Select TPM PCR bank (SHA1, SHA256)"): {
const EVP_MD *implementation;
r = DLOPEN_LIBCRYPTO(LOG_ERR, required);
r = dlopen_libcrypto(LOG_ERR);
if (r < 0)
return r;
@@ -508,6 +508,7 @@ static int run(int argc, char *argv[]) {
int r;
LIBBLKID_NOTE(recommended);
LIBCRYPTO_NOTE(required);
TPM2_NOTE(suggested);
log_setup();
src/pcrlock/pcrlock.c
+2 -1
View File
@@ -5708,6 +5708,7 @@ static int run(int argc, char *argv[]) {
int r;
LIBBLKID_NOTE(recommended);
LIBCRYPTO_NOTE(required);
LIBSELINUX_NOTE(recommended);
TPM2_NOTE(suggested);
@@ -5722,7 +5723,7 @@ static int run(int argc, char *argv[]) {
if (r <= 0)
return r;
r = DLOPEN_LIBCRYPTO(LOG_ERR, required);
r = dlopen_libcrypto(LOG_ERR);
if (r < 0)
return r;
src/portable/portable.c
+2 -2
View File
@@ -616,8 +616,8 @@ static int portable_extract_by_path(
* there, and extract the metadata we need. The metadata is sent from the child back to us. */
/* Load some libraries before we fork workers off that want to use them */
(void) DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
(void) DLOPEN_LIBMOUNT(LOG_DEBUG, required);
(void) dlopen_cryptsetup(LOG_DEBUG);
(void) dlopen_libmount(LOG_DEBUG);
r = mkdtemp_malloc("/tmp/inspect-XXXXXX", &tmpdir);
if (r < 0)
src/portable/portabled.c
+2
View File
@@ -146,6 +146,8 @@ static int run(int argc, char *argv[]) {
LIBBLKID_NOTE(recommended);
LIBCRYPTO_NOTE(suggested);
LIBCRYPTSETUP_NOTE(recommended);
LIBMOUNT_NOTE(required);
LIBSELINUX_NOTE(recommended);
log_setup();
src/repart/repart.c
+13 -8
View File
@@ -3108,7 +3108,7 @@ static int partition_read_definition(
"Cannot format %s filesystem without source files, refusing.", p->format);
if (p->verity != VERITY_OFF || p->encrypt != ENCRYPT_OFF) {
r = DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
r = dlopen_cryptsetup(LOG_DEBUG);
if (r < 0)
return log_syntax(NULL, LOG_ERR, path, 1, r,
"libcryptsetup not found, Verity=/Encrypt= are not supported: %m");
@@ -4758,7 +4758,7 @@ static int context_wipe_range(Context *context, uint64_t offset, uint64_t size)
assert(offset != UINT64_MAX);
assert(size != UINT64_MAX);
r = DLOPEN_LIBBLKID(LOG_ERR, required);
r = dlopen_libblkid(LOG_ERR);
if (r < 0)
return r;
@@ -5459,7 +5459,7 @@ static int partition_encrypt(Context *context, Partition *p, PartitionTarget *ta
assert(p);
assert(p->encrypt != ENCRYPT_OFF);
r = DLOPEN_CRYPTSETUP(LOG_ERR, recommended);
r = dlopen_cryptsetup(LOG_ERR);
if (r < 0)
return r;
@@ -6002,7 +6002,7 @@ static int partition_format_verity_hash(
(void) partition_hint(p, node, &hint);
r = DLOPEN_CRYPTSETUP(LOG_ERR, recommended);
r = dlopen_cryptsetup(LOG_ERR);
if (r < 0)
return r;
@@ -6107,7 +6107,7 @@ static int sign_verity_roothash(
assert(iovec_is_set(roothash));
assert(ret_signature);
r = DLOPEN_LIBCRYPTO(LOG_ERR, recommended);
r = dlopen_libcrypto(LOG_ERR);
if (r < 0)
return r;
@@ -7218,7 +7218,7 @@ static int partition_populate_filesystem(Context *context, Partition *p, const c
* appear in the host namespace. Hence we fork a child that has its own file system namespace and
* detached mount propagation. */
(void) DLOPEN_LIBMOUNT(LOG_DEBUG, required);
(void) dlopen_libmount(LOG_DEBUG);
r = pidref_safe_fork(
"(sd-copy)",
@@ -8854,7 +8854,7 @@ static int resolve_copy_blocks_auto_candidate(
return log_error_errno(r, "Failed to open block device " DEVNUM_FORMAT_STR ": %m",
DEVNUM_FORMAT_VAL(whole_devno));
r = DLOPEN_LIBBLKID(LOG_ERR, required);
r = dlopen_libblkid(LOG_ERR);
if (r < 0)
return r;
@@ -11710,6 +11710,11 @@ static int run(int argc, char *argv[]) {
bool node_is_our_loop = false;
int r;
LIBBLKID_NOTE(required);
LIBCRYPTO_NOTE(recommended);
LIBCRYPTSETUP_NOTE(recommended);
LIBFDISK_NOTE(required);
LIBMOUNT_NOTE(required);
LIBSELINUX_NOTE(recommended);
TPM2_NOTE(suggested);
@@ -11719,7 +11724,7 @@ static int run(int argc, char *argv[]) {
if (r <= 0)
return r;
r = DLOPEN_FDISK(LOG_ERR, required);
r = dlopen_fdisk(LOG_ERR);
if (r < 0)
return r;
src/report/report-sign-plain.c
+4 -1
View File
@@ -9,6 +9,7 @@
#include "alloc-util.h"
#include "build.h"
#include "crypto-util.h"
#include "dlopen-note.h"
#include "errno-util.h"
#include "fd-util.h"
#include "fileio.h"
@@ -304,7 +305,7 @@ static int vl_server(void) {
_cleanup_(sd_varlink_server_unrefp) sd_varlink_server *vs = NULL;
int r;
r = DLOPEN_LIBCRYPTO(LOG_ERR, required);
r = dlopen_libcrypto(LOG_ERR);
if (r < 0)
return r;
@@ -391,6 +392,8 @@ static int parse_argv(int argc, char *argv[]) {
static int run(int argc, char *argv[]) {
int r;
LIBCRYPTO_NOTE(required);
log_setup();
r = parse_argv(argc, argv);
src/report/report-upload.c
+1 -1
View File
@@ -64,7 +64,7 @@ static int http_upload_report(Context *context, sd_json_variant *report) {
char error[CURL_ERROR_SIZE] = {};
int r;
r = DLOPEN_CURL(LOG_DEBUG, required);
r = dlopen_curl(LOG_DEBUG);
if (r < 0)
return r;
src/report/report.c
+3
View File
@@ -7,6 +7,7 @@
#include "build.h"
#include "chase.h"
#include "dirent-util.h"
#include "dlopen-note.h"
#include "format-table.h"
#include "help-util.h"
#include "log.h"
@@ -1024,6 +1025,8 @@ static int run(int argc, char *argv[]) {
char **args = NULL;
int r;
LIBCURL_NOTE(required);
log_setup();
/* If invoked as a socket-activated Varlink service (Accept=yes), act as the io.systemd.Report
src/resolve/resolvectl.c
+1
View File
@@ -3794,6 +3794,7 @@ static int run(int argc, char **argv) {
int r;
LIBCRYPTO_NOTE(suggested);
LIBIDN2_NOTE(recommended);
setlocale(LC_ALL, "");
log_setup();
src/resolve/resolved-dns-dnssec.c
+3 -3
View File
@@ -735,7 +735,7 @@ int dnssec_verify_rrset(
assert(dnskey);
assert(result);
r = DLOPEN_LIBCRYPTO(LOG_WARNING, recommended);
r = dlopen_libcrypto(LOG_WARNING);
if (r < 0)
return r;
@@ -1092,7 +1092,7 @@ int dnssec_verify_dnskey_by_ds(DnsResourceRecord *dnskey, DnsResourceRecord *ds,
assert(dnskey);
assert(ds);
r = DLOPEN_LIBCRYPTO(LOG_WARNING, recommended);
r = dlopen_libcrypto(LOG_WARNING);
if (r < 0)
return r;
@@ -1232,7 +1232,7 @@ int dnssec_nsec3_hash(DnsResourceRecord *nsec3, const char *name, void *ret) {
assert(name);
assert(ret);
r = DLOPEN_LIBCRYPTO(LOG_WARNING, recommended);
r = dlopen_libcrypto(LOG_WARNING);
if (r < 0)
return r;
src/resolve/resolved-dnstls.c
+2 -2
View File
@@ -412,11 +412,11 @@ int dnstls_manager_init(Manager *manager) {
if (manager->dnstls_data.ctx)
return 0;
r = DLOPEN_LIBCRYPTO(LOG_WARNING, recommended);
r = dlopen_libcrypto(LOG_WARNING);
if (r < 0)
return r;
r = DLOPEN_LIBSSL(LOG_WARNING, recommended);
r = dlopen_libssl(LOG_WARNING);
if (r < 0)
return r;
src/resolve/resolved-util.c
+1 -1
View File
@@ -36,7 +36,7 @@ int resolve_system_hostname(char **full_hostname, char **first_label) {
#if HAVE_LIBIDN2
_cleanup_free_ char *utf8 = NULL;
if (DLOPEN_IDN(LOG_DEBUG, recommended) >= 0) {
if (dlopen_idn(LOG_DEBUG) >= 0) {
r = sym_idn2_to_unicode_8z8z(label, &utf8, 0);
if (r != IDN2_OK)
return log_debug_errno(SYNTHETIC_ERRNO(EUCLEAN),
src/resolve/resolved.c
+3
View File
@@ -25,7 +25,10 @@ static int run(int argc, char *argv[]) {
_unused_ _cleanup_(notify_on_cleanup) const char *notify_stop = NULL;
int r;
LIBCRYPTO_NOTE(recommended);
LIBIDN2_NOTE(recommended);
LIBSELINUX_NOTE(recommended);
LIBSSL_NOTE(recommended);
log_setup();
src/sbsign/sbsign.c
+4 -1
View File
@@ -9,6 +9,7 @@
#include "build.h"
#include "copy.h"
#include "crypto-util.h"
#include "dlopen-note.h"
#include "efi.h"
#include "fd-util.h"
#include "fileio.h"
@@ -406,7 +407,7 @@ static int verb_sign(int argc, char *argv[], uintptr_t _data, void *userdata) {
_cleanup_(iovec_done) struct iovec signed_attributes_signature = {};
int r;
r = DLOPEN_LIBCRYPTO(LOG_ERR, required);
r = dlopen_libcrypto(LOG_ERR);
if (r < 0)
return r;
@@ -697,6 +698,8 @@ static int verb_sign(int argc, char *argv[], uintptr_t _data, void *userdata) {
static int run(int argc, char *argv[]) {
int r;
LIBCRYPTO_NOTE(required);
log_setup();
char **args = NULL;
src/shared/acl-util.c
+1 -1
View File
@@ -47,7 +47,7 @@ int dlopen_libacl(int log_level) {
#if HAVE_ACL
static void *libacl_dl = NULL;
LIBACL_NOTE(recommended);
LIBACL_NOTE(suggested);
return dlopen_many_sym_or_warn(
&libacl_dl,
src/shared/acl-util.h
-6
View File
@@ -99,12 +99,6 @@ static inline int fd_add_uid_acl_permission(int fd, uid_t uid, unsigned mask) {
int dlopen_libacl(int log_level) _dlopen_loader_;
#define DLOPEN_LIBACL(log_level, priority) \
({ \
LIBACL_NOTE(priority); \
dlopen_libacl(log_level); \
})
int fd_acl_make_read_only(int fd);
int fd_acl_make_writable(int fd);
src/shared/apparmor-util.c
+1 -1
View File
@@ -46,7 +46,7 @@ int dlopen_libapparmor(int log_level) {
#if HAVE_APPARMOR
static void *libapparmor_dl = NULL;
LIBAPPARMOR_NOTE(recommended);
LIBAPPARMOR_NOTE(suggested);
return dlopen_many_sym_or_warn(
&libapparmor_dl,
src/shared/blkid-util.c
+1 -1
View File
@@ -98,7 +98,7 @@ int dlopen_libblkid(int log_level) {
#if HAVE_BLKID
static void *libblkid_dl = NULL;
LIBBLKID_NOTE(recommended);
LIBBLKID_NOTE(suggested);
return dlopen_many_sym_or_warn(
&libblkid_dl,
src/shared/blkid-util.h
-6
View File
@@ -70,9 +70,3 @@ int blkid_probe_lookup_value_u64(blkid_probe b, const char *field, uint64_t *ret
#endif
int dlopen_libblkid(int log_level) _dlopen_loader_;
#define DLOPEN_LIBBLKID(log_level, priority) \
({ \
LIBBLKID_NOTE(priority); \
dlopen_libblkid(log_level); \
})
src/shared/bpf-util.h
-6
View File
@@ -95,9 +95,3 @@ int bpf_get_error_translated(const void *ptr);
#endif
int dlopen_bpf(int log_level) _dlopen_loader_;
#define DLOPEN_BPF(log_level, priority) \
({ \
LIBBPF_NOTE(priority); \
dlopen_bpf(log_level); \
})
src/shared/crypto-util.h
-6
View File
@@ -449,12 +449,6 @@ DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(OpenSSLAskPasswordUI*, openssl_ask_password_ui_
int dlopen_libcrypto(int log_level) _dlopen_loader_;
bool dlopen_libcrypto_has_argon2id(void);
#define DLOPEN_LIBCRYPTO(log_level, priority) \
({ \
LIBCRYPTO_NOTE(priority); \
dlopen_libcrypto(log_level); \
})
typedef struct Argon2IdParameters {
uint64_t memcost_bytes;
uint32_t iterations;
src/shared/cryptsetup-util.h
-6
View File
@@ -101,12 +101,6 @@ int cryptsetup_get_volume_key_id(struct crypt_device *cd, const char *volume_nam
int dlopen_cryptsetup(int log_level) _dlopen_loader_;
#define DLOPEN_CRYPTSETUP(log_level, priority) \
({ \
LIBCRYPTSETUP_NOTE(priority); \
dlopen_cryptsetup(log_level); \
})
int cryptsetup_get_keyslot_from_token(sd_json_variant *v);
const char* mangle_none(const char *s);
src/shared/curl-util.h
-6
View File
@@ -78,9 +78,3 @@ DEFINE_TRIVIAL_CLEANUP_FUNC_FULL_RENAME(struct curl_slist*, sym_curl_slist_free_
#endif
int dlopen_curl(int log_level) _dlopen_loader_;
#define DLOPEN_CURL(log_level, priority) \
({ \
LIBCURL_NOTE(priority); \
dlopen_curl(log_level); \
})
src/shared/fdisk-util.h
-6
View File
@@ -90,9 +90,3 @@ int fdisk_partition_set_attrs_as_uint64(struct fdisk_partition *pa, uint64_t fla
#endif
int dlopen_fdisk(int log_level) _dlopen_loader_;
#define DLOPEN_FDISK(log_level, priority) \
({ \
LIBFDISK_NOTE(priority); \
dlopen_fdisk(log_level); \
})
src/shared/idn-util.h
-6
View File
@@ -19,9 +19,3 @@ extern DLSYM_PROTOTYPE(idn2_to_unicode_8z8z);
#endif
int dlopen_idn(int log_level) _dlopen_loader_;
#define DLOPEN_IDN(log_level, priority) \
({ \
LIBIDN2_NOTE(priority); \
dlopen_idn(log_level); \
})
src/shared/libarchive-util.h
-6
View File
@@ -86,9 +86,3 @@ DEFINE_TRIVIAL_CLEANUP_FUNC_FULL_RENAME(struct archive*, sym_archive_read_free,
#endif
int dlopen_libarchive(int log_level) _dlopen_loader_;
#define DLOPEN_LIBARCHIVE(log_level, priority) \
({ \
LIBARCHIVE_NOTE(priority); \
dlopen_libarchive(log_level); \
})
src/shared/libaudit-util.c
+1 -1
View File
@@ -23,7 +23,7 @@ int dlopen_libaudit(int log_level) {
#if HAVE_AUDIT
static void *libaudit_dl = NULL;
LIBAUDIT_NOTE(recommended);
LIBAUDIT_NOTE(suggested);
return dlopen_many_sym_or_warn(
&libaudit_dl,
src/shared/libcrypt-util.c
+1 -1
View File
@@ -142,7 +142,7 @@ int dlopen_libcrypt(int log_level) {
if (cached < 0)
return cached; /* Already tried, and failed. */
LIBCRYPT_NOTE(recommended);
LIBCRYPT_NOTE(suggested);
/* Several distributions like Debian/Ubuntu and OpenSUSE provide libxcrypt as libcrypt.so.1
* (libcrypt.so.1.1 on some architectures), while others like Fedora/CentOS and Arch provide it as
src/shared/libmount-util.c
+1 -1
View File
@@ -118,7 +118,7 @@ int dlopen_libmount(int log_level) {
#if HAVE_LIBMOUNT
static void *libmount_dl = NULL;
LIBMOUNT_NOTE(recommended);
LIBMOUNT_NOTE(suggested);
return dlopen_many_sym_or_warn(
&libmount_dl,
src/shared/libmount-util.h
-6
View File
@@ -89,9 +89,3 @@ static inline void* sym_mnt_unref_monitor(struct libmnt_monitor *p) {
#endif
int dlopen_libmount(int log_level) _dlopen_loader_;
#define DLOPEN_LIBMOUNT(log_level, priority) \
({ \
LIBMOUNT_NOTE(priority); \
dlopen_libmount(log_level); \
})
src/shared/microhttpd-util.h
-6
View File
@@ -138,9 +138,3 @@ DEFINE_TRIVIAL_CLEANUP_FUNC_FULL_RENAME(struct MHD_Response*, sym_MHD_destroy_re
#endif
int dlopen_microhttpd(int log_level) _dlopen_loader_;
#define DLOPEN_MICROHTTPD(log_level, priority) \
({ \
LIBMICROHTTPD_NOTE(priority); \
dlopen_microhttpd(log_level); \
})
src/shared/module-util.c
+1 -1
View File
@@ -171,7 +171,7 @@ int dlopen_libkmod(int log_level) {
#if HAVE_KMOD
static void *libkmod_dl = NULL;
LIBKMOD_NOTE(recommended);
LIBKMOD_NOTE(suggested);
return dlopen_many_sym_or_warn(
&libkmod_dl,
src/shared/module-util.h
-6
View File
@@ -54,9 +54,3 @@ static inline int module_load_and_warn(struct kmod_ctx *ctx, const char *module,
#endif
int dlopen_libkmod(int log_level) _dlopen_loader_;
#define DLOPEN_LIBKMOD(log_level, priority) \
({ \
LIBKMOD_NOTE(priority); \
dlopen_libkmod(log_level); \
})
src/shared/pam-util.c
+1 -1
View File
@@ -382,7 +382,7 @@ int dlopen_libpam(int log_level) {
#if HAVE_PAM
static void *libpam_dl = NULL;
LIBPAM_NOTE(recommended);
LIBPAM_NOTE(suggested);
return dlopen_many_sym_or_warn(
&libpam_dl,
src/shared/pam-util.h
-6
View File
@@ -111,9 +111,3 @@ int pam_putenv_assign(pam_handle_t *pamh, const char *name, const char *value);
#endif
int dlopen_libpam(int log_level) _dlopen_loader_;
#define DLOPEN_LIBPAM(log_level, priority) \
({ \
LIBPAM_NOTE(priority); \
dlopen_libpam(log_level); \
})
src/shared/seccomp-util.c
+1 -1
View File
@@ -2601,7 +2601,7 @@ int dlopen_libseccomp(int log_level) {
#if HAVE_SECCOMP
static void *libseccomp_dl = NULL;
LIBSECCOMP_NOTE(recommended);
LIBSECCOMP_NOTE(suggested);
return dlopen_many_sym_or_warn(
&libseccomp_dl,
src/shared/seccomp-util.h
-7
View File
@@ -166,17 +166,10 @@ static inline bool is_seccomp_available(void) {
return false;
}
#endif
int dlopen_libseccomp(int log_level) _dlopen_loader_;
#define DLOPEN_LIBSECCOMP(log_level, priority) \
({ \
LIBSECCOMP_NOTE(priority); \
dlopen_libseccomp(log_level); \
})
/* This is a special value to be used where syscall filters otherwise expect errno numbers, will be
replaced with real seccomp action. */
enum {
src/shared/selinux-util.c
+1 -1
View File
@@ -92,7 +92,7 @@ int dlopen_libselinux(int log_level) {
#if HAVE_SELINUX
static void *libselinux_dl = NULL;
LIBSELINUX_NOTE(recommended);
LIBSELINUX_NOTE(suggested);
return dlopen_many_sym_or_warn(
&libselinux_dl,
src/shared/selinux-util.h
-6
View File
@@ -65,12 +65,6 @@ static inline void freeconp(char **p) {
int dlopen_libselinux(int log_level) _dlopen_loader_;
#define DLOPEN_LIBSELINUX(log_level, priority) \
({ \
LIBSELINUX_NOTE(priority); \
dlopen_libselinux(log_level); \
})
#define _cleanup_freecon_ _cleanup_(freeconp)
/* This accepts 0 error, like _zerook(). */
src/shared/ssl-util.h
-6
View File
@@ -48,9 +48,3 @@ DEFINE_TRIVIAL_CLEANUP_FUNC_FULL_RENAME(SSL_CTX*, sym_SSL_CTX_free, SSL_CTX_free
#endif
int dlopen_libssl(int log_level) _dlopen_loader_;
#define DLOPEN_LIBSSL(log_level, priority) \
({ \
LIBSSL_NOTE(priority); \
dlopen_libssl(log_level); \
})
src/shared/tpm2-util.h
-6
View File
@@ -59,12 +59,6 @@ int dlopen_tpm2(int log_level) _dlopen_loader_;
* other tokens. */
#define ERRNO_IS_NEG_TPM2_TOKEN_MISMATCH(r) IN_SET(r, -EREMCHG, -ENOANO, -EPERM, -ENOSTR, -EREMOTE, -EADDRNOTAVAIL)
#define DLOPEN_TPM2(log_level, priority) \
({ \
TPM2_NOTE(priority); \
dlopen_tpm2(log_level); \
})
#if HAVE_TPM2
#ifndef SYSTEMD_CFLAGS_MARKER_TPM2
# error "missing tpm2_cflags in meson dependency."
src/shutdown/detach-swap.c
+1 -1
View File
@@ -36,7 +36,7 @@ int swap_list_get(const char *swaps, SwapDevice **head) {
assert(head);
r = DLOPEN_LIBMOUNT(LOG_ERR, recommended);
r = dlopen_libmount(LOG_ERR);
if (r < 0)
return r;
src/shutdown/shutdown.c
+1
View File
@@ -379,6 +379,7 @@ int main(int argc, char *argv[]) {
size_t n_luo_fds = 0;
int cmd, r;
LIBMOUNT_NOTE(recommended);
LIBSELINUX_NOTE(recommended);
/* LUO will preserve these across kexec */
src/sysext/sysext.c
+7 -4
View File
@@ -1914,7 +1914,7 @@ static int unmerge(const Context *c) {
assert(c);
(void) DLOPEN_LIBMOUNT(LOG_DEBUG, required);
(void) dlopen_libmount(LOG_DEBUG);
r = get_extension_release_metadata(c, &need_to_reload, &units_to_restart, &units_to_reload_or_restart);
if (r < 0)
@@ -2492,9 +2492,9 @@ static int merge(const Context *c, Hashmap *images) {
assert(c);
(void) DLOPEN_CRYPTSETUP(LOG_DEBUG, recommended);
(void) DLOPEN_LIBBLKID(LOG_DEBUG, required);
(void) DLOPEN_LIBMOUNT(LOG_DEBUG, required);
(void) dlopen_cryptsetup(LOG_DEBUG);
(void) dlopen_libblkid(LOG_DEBUG);
(void) dlopen_libmount(LOG_DEBUG);
_cleanup_(pidref_done) PidRef pidref = PIDREF_NULL;
r = pidref_safe_fork("(sd-merge)", FORK_DEATHSIG_SIGTERM|FORK_LOG|FORK_NEW_MOUNTNS, &pidref);
@@ -3271,7 +3271,10 @@ static int run(int argc, char *argv[]) {
char **args = NULL;
int r;
LIBBLKID_NOTE(required);
LIBCRYPTO_NOTE(suggested);
LIBCRYPTSETUP_NOTE(recommended);
LIBMOUNT_NOTE(required);
LIBSELINUX_NOTE(recommended);
log_setup();
src/sysupdate/sysupdate-partition.c
+2 -2
View File
@@ -161,7 +161,7 @@ int find_suitable_partition(
POINTER_MAY_BE_NULL(partition_type);
assert(ret);
r = DLOPEN_FDISK(LOG_DEBUG, recommended);
r = dlopen_fdisk(LOG_DEBUG);
if (r < 0)
return r;
@@ -230,7 +230,7 @@ int patch_partition(
if (change == 0) /* Nothing to do */
return 0;
r = DLOPEN_FDISK(LOG_DEBUG, recommended);
r = dlopen_fdisk(LOG_DEBUG);
if (r < 0)
return r;
src/sysupdate/sysupdate-resource.c
+1 -1
View File
@@ -266,7 +266,7 @@ static int resource_load_from_blockdev(Resource *rr) {
assert(rr);
r = DLOPEN_FDISK(LOG_DEBUG, recommended);
r = dlopen_fdisk(LOG_DEBUG);
if (r < 0)
return r;
src/sysupdate/sysupdate.c
+1
View File
@@ -3568,6 +3568,7 @@ static int run(int argc, char *argv[]) {
LIBBLKID_NOTE(recommended);
LIBCRYPTO_NOTE(suggested);
LIBCRYPTSETUP_NOTE(suggested);
LIBFDISK_NOTE(recommended);
LIBMOUNT_NOTE(recommended);
LIBSELINUX_NOTE(recommended);
LIBTSS2_ESYS_NOTE(suggested);
src/tmpfiles/tmpfiles.c
+3 -2
View File
@@ -1271,7 +1271,7 @@ static int parse_acl_cond_exec(
assert(cond_exec);
assert(ret);
r = DLOPEN_LIBACL(LOG_DEBUG, recommended);
r = dlopen_libacl(LOG_DEBUG);
if (r < 0)
return r;
@@ -1390,7 +1390,7 @@ static int path_set_acl(
assert(c);
r = DLOPEN_LIBACL(LOG_DEBUG, recommended);
r = dlopen_libacl(LOG_DEBUG);
if (r < 0)
return r;
@@ -4854,6 +4854,7 @@ static int run(int argc, char *argv[]) {
} phase;
int r;
LIBACL_NOTE(recommended);
LIBBLKID_NOTE(recommended);
LIBCRYPTSETUP_NOTE(suggested);
LIBCRYPTO_NOTE(suggested);
src/tpm2-setup/tpm2-setup.c
+4 -2
View File
@@ -601,12 +601,14 @@ static int run(int argc, char *argv[]) {
}
LIBBLKID_NOTE(recommended);
LIBCRYPTO_NOTE(required);
TPM2_NOTE(required);
r = DLOPEN_LIBCRYPTO(LOG_ERR, required);
r = dlopen_libcrypto(LOG_ERR);
if (r < 0)
return r;
r = DLOPEN_TPM2(LOG_ERR, required);
r = dlopen_tpm2(LOG_ERR);
if (r < 0)
return r;

Some files were not shown because too many files have changed in this diff Show More