Aside from the IFUNC mechanism (which #musl doesn't and won't support, btw), the one way for libraries that get linked but not used to run code is as global constructors.
Wouldn't it be nice if distros could just audit for which libs have global ctors, and apply greater scrutiny to pulling ones that do into sensitive programs?
Well...
🧵
Follow
What about getting called by defining a symbol that is normally exported by another library?
