From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Mon, 6 Jul 2026 22:51:50 +0000 (+0900)
Subject: sd-dlopen: introduce _dlopen_loader_ macro to prevent inlining and cloning
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=01e02cb94fa5f7ea99a85e96021a3f1d52e80364;p=thirdparty%2Fsystemd.git

sd-dlopen: introduce _dlopen_loader_ macro to prevent inlining and cloning

When compiler optimization or LTO (Link Time Optimization) is enabled,
dlopen helper functions (such as dlopen_libfoo()) can be aggressively
inlined into their callers or cloned for specific call sites.

While this is beneficial for production builds, it alters or completely
removes the original function symbols from the final executable.
Consequently, this breaks the test (to be added in this series) that
checks whether the dlopen_libfoo() function corresponding to a dlopen
ELF note is actually called.

To resolve this, introduce the `_dlopen_loader_` macro. Under developer
builds, it applies the `_noclone_` and `_noinline_` attributes to guarantee
that helper symbols remain intact and discoverable by the test suite. In
production builds, the macro evaluates to nothing, allowing full compiler
optimization to proceed unimpeded.
---

diff --git a/src/basic/compress.c b/src/basic/compress.c
index 350c612eae7..5936a13f8e8 100644
--- a/src/basic/compress.c
+++ b/src/basic/compress.c
@@ -47,7 +47,6 @@
 #include "bitfield.h"
 #include "compress.h"
 #include "dlfcn-util.h"
-#include "dlopen-note.h"
 #include "io-util.h"
 #include "log.h"
 #include "string-table.h"
diff --git a/src/basic/compress.h b/src/basic/compress.h
index e7beb330cb4..52fdf3aa272 100644
--- a/src/basic/compress.h
+++ b/src/basic/compress.h
@@ -2,6 +2,7 @@
 #pragma once
 
 #include "basic-forward.h"
+#include "dlopen-note.h"
 
 typedef enum Compression {
         COMPRESSION_NONE,
@@ -80,11 +81,11 @@ int compress_stream(Compression type, int fdf, int fdt, uint64_t max_bytes, uint
 int decompress_stream(Compression type, int fdf, int fdt, uint64_t max_bytes);
 int decompress_stream_by_filename(const char *filename, int fdf, int fdt, uint64_t max_bytes);
 
-int dlopen_xz(int log_level);
-int dlopen_lz4(int log_level);
-int dlopen_zstd(int log_level);
-int dlopen_zlib(int log_level);
-int dlopen_bzip2(int log_level);
+int dlopen_xz(int log_level) _dlopen_loader_;
+int dlopen_lz4(int log_level) _dlopen_loader_;
+int dlopen_zstd(int log_level) _dlopen_loader_;
+int dlopen_zlib(int log_level) _dlopen_loader_;
+int dlopen_bzip2(int log_level) _dlopen_loader_;
 
 static inline const char* default_compression_extension(void) {
         return compression_extension_to_string(DEFAULT_COMPRESSION) ?: "";
diff --git a/src/basic/dlopen-note.h b/src/basic/dlopen-note.h
index 302dd0999a0..41661939a1f 100644
--- a/src/basic/dlopen-note.h
+++ b/src/basic/dlopen-note.h
@@ -6,6 +6,16 @@
 #include "basic-forward.h"
 #include "strv.h"
 
+/* Prevent dlopen helper functions (e.g., dlopen_libfoo()) from being inlined or cloned by the compiler/LTO.
+ * This ensures that their specific symbols remain intact in the final executable, allowing the developer
+ * test utility to verify that the functions corresponding to the dlopen ELF notes are actually invoked.
+ * This is restricted to BUILD_MODE_DEVELOPER to avoid degrading production performance. */
+#if BUILD_MODE_DEVELOPER
+#  define _dlopen_loader_ _noclone_ _noinline_
+#else
+#  define _dlopen_loader_
+#endif
+
 /* Avoid invalid priority. */
 #define _DLOPEN_CHECK_PRIORITY_required    1
 #define _DLOPEN_CHECK_PRIORITY_recommended 1
diff --git a/src/fundamental/macro.h b/src/fundamental/macro.h
index 12f2aa81dcd..98d43ced317 100644
--- a/src/fundamental/macro.h
+++ b/src/fundamental/macro.h
@@ -83,6 +83,11 @@
 #define _hidden_ __attribute__((__visibility__("hidden")))
 #define _likely_(x) (__builtin_expect(!!(x), 1))
 #define _malloc_ __attribute__((__malloc__))
+#ifdef __clang__
+#  define _noclone_
+#else
+#  define _noclone_ __attribute__((noclone))
+#endif
 #define _noinline_ __attribute__((noinline))
 #define _noreturn_ _Noreturn
 #define _packed_ __attribute__((__packed__))
diff --git a/src/locale/xkbcommon-util.c b/src/locale/xkbcommon-util.c
index 55ff67588e9..1f21ba5a068 100644
--- a/src/locale/xkbcommon-util.c
+++ b/src/locale/xkbcommon-util.c
@@ -13,6 +13,7 @@ DLSYM_PROTOTYPE(xkb_context_set_log_fn) = NULL;
 DLSYM_PROTOTYPE(xkb_keymap_new_from_names) = NULL;
 DLSYM_PROTOTYPE(xkb_keymap_unref) = NULL;
 
+_dlopen_loader_
 static int dlopen_xkbcommon(int log_level) {
         static void *xkbcommon_dl = NULL;
 
diff --git a/src/shared/acl-util.h b/src/shared/acl-util.h
index c06900008d7..6c29e85135d 100644
--- a/src/shared/acl-util.h
+++ b/src/shared/acl-util.h
@@ -97,7 +97,7 @@ static inline int fd_add_uid_acl_permission(int fd, uid_t uid, unsigned mask) {
 }
 #endif
 
-int dlopen_libacl(int log_level);
+int dlopen_libacl(int log_level) _dlopen_loader_;
 
 #define DLOPEN_LIBACL(log_level, priority)                              \
         ({                                                              \
diff --git a/src/shared/apparmor-util.c b/src/shared/apparmor-util.c
index a2b3179c90e..dce21d1e69b 100644
--- a/src/shared/apparmor-util.c
+++ b/src/shared/apparmor-util.c
@@ -1,7 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include "apparmor-util.h"
-#include "dlopen-note.h"
 #include "log.h"
 
 #if HAVE_APPARMOR
diff --git a/src/shared/apparmor-util.h b/src/shared/apparmor-util.h
index 2d47a341cb9..69e937eade3 100644
--- a/src/shared/apparmor-util.h
+++ b/src/shared/apparmor-util.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "dlopen-note.h"
 #include "shared-forward.h"
 
 #if HAVE_APPARMOR
@@ -30,4 +31,4 @@ static inline bool mac_apparmor_use(void) {
 }
 #endif
 
-int dlopen_libapparmor(int log_level);
+int dlopen_libapparmor(int log_level) _dlopen_loader_;
diff --git a/src/shared/blkid-util.h b/src/shared/blkid-util.h
index 91f6e9c8c29..5457fbc28c5 100644
--- a/src/shared/blkid-util.h
+++ b/src/shared/blkid-util.h
@@ -69,7 +69,7 @@ int blkid_probe_lookup_value_id128(blkid_probe b, const char *field, sd_id128_t
 int blkid_probe_lookup_value_u64(blkid_probe b, const char *field, uint64_t *ret);
 #endif
 
-int dlopen_libblkid(int log_level);
+int dlopen_libblkid(int log_level) _dlopen_loader_;
 
 #define DLOPEN_LIBBLKID(log_level, priority)                            \
         ({                                                              \
diff --git a/src/shared/bpf-util.h b/src/shared/bpf-util.h
index 88ef204af0e..70c7fde3c05 100644
--- a/src/shared/bpf-util.h
+++ b/src/shared/bpf-util.h
@@ -94,7 +94,7 @@ static inline int compat_bpf_map_create(
 int bpf_get_error_translated(const void *ptr);
 #endif
 
-int dlopen_bpf(int log_level);
+int dlopen_bpf(int log_level) _dlopen_loader_;
 
 #define DLOPEN_BPF(log_level, priority)                                 \
         ({                                                              \
diff --git a/src/shared/crypto-util.h b/src/shared/crypto-util.h
index f4bf7ed49ed..ebf36e2df03 100644
--- a/src/shared/crypto-util.h
+++ b/src/shared/crypto-util.h
@@ -446,7 +446,7 @@ OpenSSLAskPasswordUI* openssl_ask_password_ui_free(OpenSSLAskPasswordUI *ui);
 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(OpenSSLAskPasswordUI*, openssl_ask_password_ui_free, NULL);
 #endif
 
-int dlopen_libcrypto(int log_level);
+int dlopen_libcrypto(int log_level) _dlopen_loader_;
 
 #define DLOPEN_LIBCRYPTO(log_level, priority)                           \
         ({                                                              \
diff --git a/src/shared/cryptsetup-util.h b/src/shared/cryptsetup-util.h
index b1eb3b724e3..959f696ca08 100644
--- a/src/shared/cryptsetup-util.h
+++ b/src/shared/cryptsetup-util.h
@@ -99,7 +99,7 @@ int cryptsetup_get_volume_key_id(struct crypt_device *cd, const char *volume_nam
                                  size_t volume_key_size,  char **ret);
 #endif
 
-int dlopen_cryptsetup(int log_level);
+int dlopen_cryptsetup(int log_level) _dlopen_loader_;
 
 #define DLOPEN_CRYPTSETUP(log_level, priority)                          \
         ({                                                              \
diff --git a/src/shared/curl-util.h b/src/shared/curl-util.h
index 20f54aae59d..d76f5128eec 100644
--- a/src/shared/curl-util.h
+++ b/src/shared/curl-util.h
@@ -77,7 +77,7 @@ DEFINE_TRIVIAL_CLEANUP_FUNC_FULL_RENAME(CURL*, sym_curl_easy_cleanup, curl_easy_
 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL_RENAME(struct curl_slist*, sym_curl_slist_free_all, curl_slist_free_allp, NULL);
 #endif
 
-int dlopen_curl(int log_level);
+int dlopen_curl(int log_level) _dlopen_loader_;
 
 #define DLOPEN_CURL(log_level, priority)                                \
         ({                                                              \
diff --git a/src/shared/elf-util.c b/src/shared/elf-util.c
index 9a926e49ed3..96e917dee0d 100644
--- a/src/shared/elf-util.c
+++ b/src/shared/elf-util.c
@@ -17,7 +17,6 @@
 #include "alloc-util.h"
 #include "coredump-util.h"
 #include "dlfcn-util.h"
-#include "dlopen-note.h"
 #include "elf-util.h"
 #include "errno-util.h"
 #include "escape.h"
diff --git a/src/shared/elf-util.h b/src/shared/elf-util.h
index 7ccbec56c64..4092cdf3033 100644
--- a/src/shared/elf-util.h
+++ b/src/shared/elf-util.h
@@ -1,10 +1,11 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "dlopen-note.h"
 #include "shared-forward.h"
 
-int dlopen_dw(int log_level);
-int dlopen_elf(int log_level);
+int dlopen_dw(int log_level) _dlopen_loader_;
+int dlopen_elf(int log_level) _dlopen_loader_;
 
 bool dlopen_dw_has_dwfl_set_sysroot(void);
 
diff --git a/src/shared/fdisk-util.h b/src/shared/fdisk-util.h
index c34cde1a41e..aa1e188dba4 100644
--- a/src/shared/fdisk-util.h
+++ b/src/shared/fdisk-util.h
@@ -89,7 +89,7 @@ int fdisk_partition_get_attrs_as_uint64(struct fdisk_partition *pa, uint64_t *re
 int fdisk_partition_set_attrs_as_uint64(struct fdisk_partition *pa, uint64_t flags);
 #endif
 
-int dlopen_fdisk(int log_level);
+int dlopen_fdisk(int log_level) _dlopen_loader_;
 
 #define DLOPEN_FDISK(log_level, priority)                               \
         ({                                                              \
diff --git a/src/shared/gnutls-util.c b/src/shared/gnutls-util.c
index 96460f1e02d..71e360e4077 100644
--- a/src/shared/gnutls-util.c
+++ b/src/shared/gnutls-util.c
@@ -1,6 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include "dlopen-note.h"
 #include "gnutls-util.h"
 #include "log.h"                /* IWYU pragma: keep */
 
diff --git a/src/shared/gnutls-util.h b/src/shared/gnutls-util.h
index dd0f1d55acb..721ae7bf00b 100644
--- a/src/shared/gnutls-util.h
+++ b/src/shared/gnutls-util.h
@@ -1,9 +1,10 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "dlopen-note.h"
 #include "shared-forward.h"
 
-int dlopen_gnutls(int log_level);
+int dlopen_gnutls(int log_level) _dlopen_loader_;
 
 #if HAVE_GNUTLS
 #  ifndef SYSTEMD_CFLAGS_MARKER_LIBGNUTLS
diff --git a/src/shared/idn-util.h b/src/shared/idn-util.h
index cf7e8a86178..c143317ebfd 100644
--- a/src/shared/idn-util.h
+++ b/src/shared/idn-util.h
@@ -18,7 +18,7 @@ extern const char *(*sym_idn2_strerror)(int rc) _const_;
 extern DLSYM_PROTOTYPE(idn2_to_unicode_8z8z);
 #endif
 
-int dlopen_idn(int log_level);
+int dlopen_idn(int log_level) _dlopen_loader_;
 
 #define DLOPEN_IDN(log_level, priority)                                 \
         ({                                                              \
diff --git a/src/shared/libarchive-util.h b/src/shared/libarchive-util.h
index 775ede55b97..fca7ef206b4 100644
--- a/src/shared/libarchive-util.h
+++ b/src/shared/libarchive-util.h
@@ -85,7 +85,7 @@ DEFINE_TRIVIAL_CLEANUP_FUNC_FULL_RENAME(struct archive*, sym_archive_write_free,
 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL_RENAME(struct archive*, sym_archive_read_free, archive_read_freep, NULL);
 #endif
 
-int dlopen_libarchive(int log_level);
+int dlopen_libarchive(int log_level) _dlopen_loader_;
 
 #define DLOPEN_LIBARCHIVE(log_level, priority)                          \
         ({                                                              \
diff --git a/src/shared/libaudit-util.c b/src/shared/libaudit-util.c
index 481eda7294e..1a1975e8038 100644
--- a/src/shared/libaudit-util.c
+++ b/src/shared/libaudit-util.c
@@ -4,7 +4,6 @@
 #include <linux/netlink.h>
 #include <sys/socket.h>
 
-#include "dlopen-note.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "iovec-util.h"
diff --git a/src/shared/libaudit-util.h b/src/shared/libaudit-util.h
index d16e25df671..d2e827d4796 100644
--- a/src/shared/libaudit-util.h
+++ b/src/shared/libaudit-util.h
@@ -1,9 +1,10 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "dlopen-note.h"
 #include "shared-forward.h"
 
-int dlopen_libaudit(int log_level);
+int dlopen_libaudit(int log_level) _dlopen_loader_;
 
 #if HAVE_AUDIT
 #  ifndef SYSTEMD_CFLAGS_MARKER_LIBAUDIT
diff --git a/src/shared/libcrypt-util.c b/src/shared/libcrypt-util.c
index 0a72e4e25a2..17a2ad746ba 100644
--- a/src/shared/libcrypt-util.c
+++ b/src/shared/libcrypt-util.c
@@ -9,7 +9,6 @@
 
 #include "alloc-util.h"
 #include "dlfcn-util.h"
-#include "dlopen-note.h"
 #include "errno-util.h"
 #include "libcrypt-util.h"
 #include "log.h"
diff --git a/src/shared/libcrypt-util.h b/src/shared/libcrypt-util.h
index 5c469b662cf..56e39d26a1f 100644
--- a/src/shared/libcrypt-util.h
+++ b/src/shared/libcrypt-util.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "dlopen-note.h"
 #include "shared-forward.h"
 
 #if HAVE_LIBCRYPT
@@ -16,6 +17,6 @@ static inline int hash_password(const char *password, char **ret) {
 }
 #endif
 
-int dlopen_libcrypt(int log_level);
+int dlopen_libcrypt(int log_level) _dlopen_loader_;
 
 bool looks_like_hashed_password(const char *s);
diff --git a/src/shared/libfido2-util.c b/src/shared/libfido2-util.c
index 0276e639533..3824c06bad7 100644
--- a/src/shared/libfido2-util.c
+++ b/src/shared/libfido2-util.c
@@ -1,6 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include "dlopen-note.h"
 #include "libfido2-util.h"
 #include "log.h"
 
diff --git a/src/shared/libfido2-util.h b/src/shared/libfido2-util.h
index 82705a7f23d..d1b90066dfc 100644
--- a/src/shared/libfido2-util.h
+++ b/src/shared/libfido2-util.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "dlopen-note.h"
 #include "shared-forward.h"
 
 #define FIDO2_SALT_SIZE 32U
@@ -16,7 +17,7 @@ typedef enum Fido2EnrollFlags {
         _FIDO2ENROLL_TYPE_INVALID = -EINVAL,
 } Fido2EnrollFlags;
 
-int dlopen_libfido2(int log_level);
+int dlopen_libfido2(int log_level) _dlopen_loader_;
 
 #if HAVE_LIBFIDO2
 #ifndef SYSTEMD_CFLAGS_MARKER_LIBFIDO2
diff --git a/src/shared/libmount-util.h b/src/shared/libmount-util.h
index 20195a13c8b..309798ac0ae 100644
--- a/src/shared/libmount-util.h
+++ b/src/shared/libmount-util.h
@@ -88,7 +88,7 @@ static inline void* sym_mnt_unref_monitor(struct libmnt_monitor *p) {
 
 #endif
 
-int dlopen_libmount(int log_level);
+int dlopen_libmount(int log_level) _dlopen_loader_;
 
 #define DLOPEN_LIBMOUNT(log_level, priority)                            \
         ({                                                              \
diff --git a/src/shared/microhttpd-util.h b/src/shared/microhttpd-util.h
index 524d73b8a25..7b777e2f33c 100644
--- a/src/shared/microhttpd-util.h
+++ b/src/shared/microhttpd-util.h
@@ -137,7 +137,7 @@ DEFINE_TRIVIAL_CLEANUP_FUNC_FULL_RENAME(struct MHD_Daemon*, sym_MHD_stop_daemon,
 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL_RENAME(struct MHD_Response*, sym_MHD_destroy_response, MHD_destroy_responsep, NULL);
 #endif
 
-int dlopen_microhttpd(int log_level);
+int dlopen_microhttpd(int log_level) _dlopen_loader_;
 
 #define DLOPEN_MICROHTTPD(log_level, priority)                          \
         ({                                                              \
diff --git a/src/shared/module-util.h b/src/shared/module-util.h
index 59b13d01cfc..c315fdaa167 100644
--- a/src/shared/module-util.h
+++ b/src/shared/module-util.h
@@ -53,7 +53,7 @@ static inline int module_load_and_warn(struct kmod_ctx *ctx, const char *module,
 
 #endif
 
-int dlopen_libkmod(int log_level);
+int dlopen_libkmod(int log_level) _dlopen_loader_;
 
 #define DLOPEN_LIBKMOD(log_level, priority)                             \
         ({                                                              \
diff --git a/src/shared/pam-util.h b/src/shared/pam-util.h
index 5f23667102d..3f1d765a336 100644
--- a/src/shared/pam-util.h
+++ b/src/shared/pam-util.h
@@ -110,7 +110,7 @@ int pam_prompt_graceful(pam_handle_t *pamh, int style, char **ret_response, cons
 int pam_putenv_assign(pam_handle_t *pamh, const char *name, const char *value);
 #endif
 
-int dlopen_libpam(int log_level);
+int dlopen_libpam(int log_level) _dlopen_loader_;
 
 #define DLOPEN_LIBPAM(log_level, priority)                              \
         ({                                                              \
diff --git a/src/shared/password-quality-util-passwdqc.c b/src/shared/password-quality-util-passwdqc.c
index 15d95b76de0..0b9beaa5080 100644
--- a/src/shared/password-quality-util-passwdqc.c
+++ b/src/shared/password-quality-util-passwdqc.c
@@ -1,6 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include "dlopen-note.h"
 #include "errno-util.h"          /* IWYU pragma: keep */
 #include "log.h"                 /* IWYU pragma: keep */
 #include "password-quality-util-passwdqc.h"
diff --git a/src/shared/password-quality-util-passwdqc.h b/src/shared/password-quality-util-passwdqc.h
index 2ae00aa620b..7c9d9e456f0 100644
--- a/src/shared/password-quality-util-passwdqc.h
+++ b/src/shared/password-quality-util-passwdqc.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "dlopen-note.h"
 #include "shared-forward.h"
 
 #if HAVE_PASSWDQC
@@ -8,4 +9,4 @@ int suggest_passwords(void);
 int check_password_quality(const char *password, const char *old, const char *username, char **ret_error);
 #endif
 
-int dlopen_passwdqc(int log_level);
+int dlopen_passwdqc(int log_level) _dlopen_loader_;
diff --git a/src/shared/password-quality-util-pwquality.c b/src/shared/password-quality-util-pwquality.c
index e045a43a77c..202b9d5009c 100644
--- a/src/shared/password-quality-util-pwquality.c
+++ b/src/shared/password-quality-util-pwquality.c
@@ -1,6 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include "dlopen-note.h"
 #include "errno-util.h"
 #include "log.h"
 #include "password-quality-util-pwquality.h"
diff --git a/src/shared/password-quality-util-pwquality.h b/src/shared/password-quality-util-pwquality.h
index 468734f590b..6499b54ee1b 100644
--- a/src/shared/password-quality-util-pwquality.h
+++ b/src/shared/password-quality-util-pwquality.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "dlopen-note.h"
 #include "shared-forward.h"
 
 #if HAVE_PWQUALITY
@@ -8,4 +9,4 @@ int suggest_passwords(void);
 int check_password_quality(const char *password, const char *old, const char *username, char **ret_error);
 #endif
 
-int dlopen_pwquality(int log_level);
+int dlopen_pwquality(int log_level) _dlopen_loader_;
diff --git a/src/shared/pcre2-util.c b/src/shared/pcre2-util.c
index 0523612bd9b..29249a89bd5 100644
--- a/src/shared/pcre2-util.c
+++ b/src/shared/pcre2-util.c
@@ -1,7 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include "dlfcn-util.h"
-#include "dlopen-note.h"
 #include "hash-funcs.h"
 #include "log.h"
 #include "pcre2-util.h"
diff --git a/src/shared/pcre2-util.h b/src/shared/pcre2-util.h
index 6b24dc49824..f2691e28e09 100644
--- a/src/shared/pcre2-util.h
+++ b/src/shared/pcre2-util.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "dlopen-note.h"
 #include "shared-forward.h"
 
 #if HAVE_PCRE2
@@ -47,4 +48,4 @@ typedef enum PatternCompileCase {
 int pattern_compile_and_log(const char *pattern, PatternCompileCase case_, pcre2_code **ret);
 int pattern_matches_and_log(pcre2_code *compiled_pattern, const char *message, size_t size, size_t *ret_ovec);
 
-int dlopen_pcre2(int log_level);
+int dlopen_pcre2(int log_level) _dlopen_loader_;
diff --git a/src/shared/pkcs11-util.c b/src/shared/pkcs11-util.c
index a9bf1e5913f..88cdffa4b61 100644
--- a/src/shared/pkcs11-util.c
+++ b/src/shared/pkcs11-util.c
@@ -4,7 +4,6 @@
 #include "ask-password-api.h"
 #include "crypto-util.h"
 #include "dlfcn-util.h"
-#include "dlopen-note.h"
 #include "env-util.h"
 #include "escape.h"
 #include "format-table.h"
diff --git a/src/shared/pkcs11-util.h b/src/shared/pkcs11-util.h
index 141fd29c338..5ccea4a6c3c 100644
--- a/src/shared/pkcs11-util.h
+++ b/src/shared/pkcs11-util.h
@@ -11,6 +11,7 @@
 
 #include "ask-password-api.h"
 #include "dlfcn-util.h"
+#include "dlopen-note.h"
 #include "pkcs11-padding.h"
 #include "shared-forward.h"
 
@@ -107,7 +108,7 @@ int pkcs11_crypt_device_callback(
 
 #endif
 
-int dlopen_p11kit(int log_level);
+int dlopen_p11kit(int log_level) _dlopen_loader_;
 
 typedef struct {
         const char *friendly_name;
diff --git a/src/shared/qrcode-util.c b/src/shared/qrcode-util.c
index 34755ca41fc..a890124bcec 100644
--- a/src/shared/qrcode-util.c
+++ b/src/shared/qrcode-util.c
@@ -12,7 +12,6 @@
 
 #include "ansi-color.h"
 #include "dlfcn-util.h"
-#include "dlopen-note.h"
 #include "locale-util.h"
 #include "log.h"
 #include "strv.h"
diff --git a/src/shared/qrcode-util.h b/src/shared/qrcode-util.h
index 667ff8e3ff7..5961aa7e47a 100644
--- a/src/shared/qrcode-util.h
+++ b/src/shared/qrcode-util.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "dlopen-note.h"
 #include "shared-forward.h"
 
 int print_qrcode_full(
@@ -13,7 +14,7 @@ int print_qrcode_full(
                 unsigned tty_height,
                 bool check_tty);
 
-int dlopen_qrencode(int log_level);
+int dlopen_qrencode(int log_level) _dlopen_loader_;
 
 static inline int print_qrcode(FILE *out, const char *header, const char *string) {
         return print_qrcode_full(out, header, string, UINT_MAX, UINT_MAX, UINT_MAX, UINT_MAX, true);
diff --git a/src/shared/seccomp-util.h b/src/shared/seccomp-util.h
index 91e6bc886e5..dd692ecfd73 100644
--- a/src/shared/seccomp-util.h
+++ b/src/shared/seccomp-util.h
@@ -169,7 +169,7 @@ static inline bool is_seccomp_available(void) {
 
 #endif
 
-int dlopen_libseccomp(int log_level);
+int dlopen_libseccomp(int log_level) _dlopen_loader_;
 
 #define DLOPEN_LIBSECCOMP(log_level, priority)                          \
         ({                                                              \
diff --git a/src/shared/selinux-util.h b/src/shared/selinux-util.h
index 5c8181131e8..747ad951561 100644
--- a/src/shared/selinux-util.h
+++ b/src/shared/selinux-util.h
@@ -63,7 +63,7 @@ static inline void freeconp(char **p) {
 
 #endif
 
-int dlopen_libselinux(int log_level);
+int dlopen_libselinux(int log_level) _dlopen_loader_;
 
 #define DLOPEN_LIBSELINUX(log_level, priority)                          \
         ({                                                              \
diff --git a/src/shared/ssl-util.h b/src/shared/ssl-util.h
index 8d60b16a1e7..156bda77b8c 100644
--- a/src/shared/ssl-util.h
+++ b/src/shared/ssl-util.h
@@ -47,7 +47,7 @@ DEFINE_TRIVIAL_CLEANUP_FUNC_FULL_RENAME(SSL*, sym_SSL_free, SSL_freep, NULL);
 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL_RENAME(SSL_CTX*, sym_SSL_CTX_free, SSL_CTX_freep, NULL);
 #endif
 
-int dlopen_libssl(int log_level);
+int dlopen_libssl(int log_level) _dlopen_loader_;
 
 #define DLOPEN_LIBSSL(log_level, priority)                              \
         ({                                                              \
diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
index 854d7fc4c55..788b153c5ab 100644
--- a/src/shared/tpm2-util.c
+++ b/src/shared/tpm2-util.c
@@ -166,6 +166,7 @@ static DLSYM_PROTOTYPE(Tss2_MU_UINT32_Marshal) = NULL;
 
 static DLSYM_PROTOTYPE(Tss2_RC_Decode) = NULL;
 
+_dlopen_loader_
 static int dlopen_tpm2_esys(int log_level) {
         static void *libtss2_esys_dl = NULL;
         int r;
@@ -229,6 +230,7 @@ static int dlopen_tpm2_esys(int log_level) {
         return 0;
 }
 
+_dlopen_loader_
 static int dlopen_tpm2_rc(int log_level) {
         static void *libtss2_rc_dl = NULL;
 
@@ -239,6 +241,7 @@ static int dlopen_tpm2_rc(int log_level) {
                         DLSYM_ARG(Tss2_RC_Decode));
 }
 
+_dlopen_loader_
 static int dlopen_tpm2_mu(int log_level) {
         static void *libtss2_mu_dl = NULL;
 
@@ -268,6 +271,7 @@ static int dlopen_tpm2_mu(int log_level) {
                         DLSYM_ARG(Tss2_MU_UINT32_Marshal));
 }
 
+_dlopen_loader_
 static int dlopen_tpm2_tcti_device(int log_level) {
         static void *libtss2_tcti_device_dl = NULL;
 
diff --git a/src/shared/tpm2-util.h b/src/shared/tpm2-util.h
index 63c449a31aa..4d2420ba03c 100644
--- a/src/shared/tpm2-util.h
+++ b/src/shared/tpm2-util.h
@@ -46,7 +46,7 @@ static inline bool TPM2_PCR_MASK_VALID(uint32_t pcr_mask) {
 
 #define TPM2_N_HASH_ALGORITHMS 4U
 
-int dlopen_tpm2(int log_level);
+int dlopen_tpm2(int log_level) _dlopen_loader_;
 
 /* tpm2_unseal() returns a bunch of different errors for various flavours of PCR issues, let's group them.
  * Kept outside the HAVE_TPM2 guard as callers switch on these errnos even in builds without TPM2. */