]> git.ipfire.org Git - thirdparty/systemd.git/commit
condition: split condition_test_list() to minimize dlopen dependencies 42908/head
authorYu Watanabe <watanabe.yu+github@gmail.com>
Thu, 9 Jul 2026 03:47:04 +0000 (12:47 +0900)
committerYu Watanabe <watanabe.yu+github@gmail.com>
Fri, 10 Jul 2026 07:35:19 +0000 (16:35 +0900)
commit337f1a319514d501ba1964c701c5f2fb933d073b
tree9d1c00ddfcaa48c00bad941ce38eeb9231df9ac4
parent05bdf4bfa9193e91532c52798a2ffc3fd8a3700c
condition: split condition_test_list() to minimize dlopen dependencies

Even though systemd-networkd and systemd-udevd do not support
ConditionSecurity= in .network, .netdev, and .link files, the unified
condition_test() function maintained a function pointer table that
unconditionally referenced condition_test_security(). Consequently,
linker garbage collection (--gc-sections) could not drop the security
test code, inadvertently pulling in dlopen dependencies and ELF notes
for apparmor, audit, and tpm2 libraries into these binaries.

To resolve this, introduce condition_test_net() and condition_test_list_net(),
which utilize a trimmed-down function pointer table that excludes
security-related condition evaluators.

By migrating networkd and udevd to these new network-specific variants,
the reference to condition_test_security() is completely severed in
their dependency chains. This allows the compiler and linker to
successfully garbage-collect the unused security logic and safely drops
the unnecessary dlopen notes from those binaries.
src/network/netdev/netdev.c
src/network/networkd-network.c
src/network/networkd.c
src/shared/condition.c
src/shared/condition.h
src/udev/net/link-config.c
src/udev/udevadm.c