homed: turn libfido2 into a dlopen() type dependency

2 files changed, 121 insertions, 103 deletions

diff --git a/src/home/homectl-fido2.c b/src/home/homectl-fido2.c
index 5557b70e67..983891e0e0 100644
--- a/src/home/homectl-fido2.c
+++ b/src/home/homectl-fido2.c
@@ -11,6 +11,7 @@
 #include "homectl-fido2.h"
 #include "homectl-pkcs11.h"
 #include "libcrypt-util.h"
+#include "libfido2-util.h"
 #include "locale-util.h"
 #include "memory-util.h"
 #include "random-util.h"
@@ -116,11 +117,11 @@ int identity_add_fido2_parameters(
                 const char *device) {
 
 #if HAVE_LIBFIDO2
-        _cleanup_(fido_cbor_info_free) fido_cbor_info_t *di = NULL;
-        _cleanup_(fido_assert_free) fido_assert_t *a = NULL;
+        _cleanup_(fido_cbor_info_free_wrapper) fido_cbor_info_t *di = NULL;
+        _cleanup_(fido_assert_free_wrapper) fido_assert_t *a = NULL;
+        _cleanup_(fido_cred_free_wrapper) fido_cred_t *c = NULL;
+        _cleanup_(fido_dev_free_wrapper) fido_dev_t *d = NULL;
         _cleanup_(erase_and_freep) char *used_pin = NULL;
-        _cleanup_(fido_cred_free) fido_cred_t *c = NULL;
-        _cleanup_(fido_dev_free) fido_dev_t *d = NULL;
         _cleanup_(erase_and_freep) void *salt = NULL;
         JsonVariant *un, *realm, *rn;
         bool found_extension = false;
@@ -146,6 +147,10 @@ int identity_add_fido2_parameters(
         assert(v);
         assert(device);
 
+        r = dlopen_libfido2();
+        if (r < 0)
+                return log_error_errno(r, "FIDO2 token support is not installed.");
+
         salt = malloc(FIDO2_SALT_SIZE);
         if (!salt)
                 return log_oom();
@@ -154,30 +159,30 @@ int identity_add_fido2_parameters(
         if (r < 0)
                 return log_error_errno(r, "Failed to generate salt: %m");
 
-        d = fido_dev_new();
+        d = sym_fido_dev_new();
         if (!d)
                 return log_oom();
 
-        r = fido_dev_open(d, device);
+        r = sym_fido_dev_open(d, device);
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to open FIDO2 device %s: %s", device, fido_strerr(r));
+                                       "Failed to open FIDO2 device %s: %s", device, sym_fido_strerr(r));
 
-        if (!fido_dev_is_fido2(d))
+        if (!sym_fido_dev_is_fido2(d))
                 return log_error_errno(SYNTHETIC_ERRNO(ENODEV),
                                        "Specified device %s is not a FIDO2 device.", device);
 
-        di = fido_cbor_info_new();
+        di = sym_fido_cbor_info_new();
         if (!di)
                 return log_oom();
 
-        r = fido_dev_get_cbor_info(d, di);
+        r = sym_fido_dev_get_cbor_info(d, di);
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to get CBOR device info for %s: %s", device, fido_strerr(r));
+                                       "Failed to get CBOR device info for %s: %s", device, sym_fido_strerr(r));
 
-        e = fido_cbor_info_extensions_ptr(di);
-        n = fido_cbor_info_extensions_len(di);
+        e = sym_fido_cbor_info_extensions_ptr(di);
+        n = sym_fido_cbor_info_extensions_len(di);
 
         for (size_t i = 0; i < n; i++)
                 if (streq(e[i], "hmac-secret")) {
@@ -189,24 +194,24 @@ int identity_add_fido2_parameters(
                 return log_error_errno(SYNTHETIC_ERRNO(ENODEV),
                                        "Specified device %s is a FIDO2 device, but does not support the required HMAC-SECRET extension.", device);
 
-        c = fido_cred_new();
+        c = sym_fido_cred_new();
         if (!c)
                 return log_oom();
 
-        r = fido_cred_set_extensions(c, FIDO_EXT_HMAC_SECRET);
+        r = sym_fido_cred_set_extensions(c, FIDO_EXT_HMAC_SECRET);
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to enable HMAC-SECRET extension on FIDO2 credential: %s", fido_strerr(r));
+                                       "Failed to enable HMAC-SECRET extension on FIDO2 credential: %s", sym_fido_strerr(r));
 
-        r = fido_cred_set_rp(c, "io.systemd.home", "Home Directory");
+        r = sym_fido_cred_set_rp(c, "io.systemd.home", "Home Directory");
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to set FIDO2 credential relying party ID/name: %s", fido_strerr(r));
+                                       "Failed to set FIDO2 credential relying party ID/name: %s", sym_fido_strerr(r));
 
-        r = fido_cred_set_type(c, COSE_ES256);
+        r = sym_fido_cred_set_type(c, COSE_ES256);
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to set FIDO2 credential type to ES256: %s", fido_strerr(r));
+                                       "Failed to set FIDO2 credential type to ES256: %s", sym_fido_strerr(r));
 
         un = json_variant_by_key(*v, "userName");
         if (!un)
@@ -231,29 +236,29 @@ int identity_add_fido2_parameters(
                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
                                        "realName field of user record is not a string");
 
-        r = fido_cred_set_user(c,
+        r = sym_fido_cred_set_user(c,
                                (const unsigned char*) fido_un, strlen(fido_un), /* We pass the user ID and name as the same */
                                fido_un,
                                rn ? json_variant_string(rn) : NULL,
                                NULL /* icon URL */);
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to set FIDO2 credential user data: %s", fido_strerr(r));
+                                       "Failed to set FIDO2 credential user data: %s", sym_fido_strerr(r));
 
-        r = fido_cred_set_clientdata_hash(c, (const unsigned char[32]) {}, 32);
+        r = sym_fido_cred_set_clientdata_hash(c, (const unsigned char[32]) {}, 32);
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to set FIDO2 client data hash: %s", fido_strerr(r));
+                                       "Failed to set FIDO2 client data hash: %s", sym_fido_strerr(r));
 
-        r = fido_cred_set_rk(c, FIDO_OPT_FALSE);
+        r = sym_fido_cred_set_rk(c, FIDO_OPT_FALSE);
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to turn off FIDO2 resident key option of credential: %s", fido_strerr(r));
+                                       "Failed to turn off FIDO2 resident key option of credential: %s", sym_fido_strerr(r));
 
-        r = fido_cred_set_uv(c, FIDO_OPT_FALSE);
+        r = sym_fido_cred_set_uv(c, FIDO_OPT_FALSE);
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to turn off FIDO2 user verification option of credential: %s", fido_strerr(r));
+                                       "Failed to turn off FIDO2 user verification option of credential: %s", sym_fido_strerr(r));
 
         log_info("Initializing FIDO2 credential on security token.");
 
@@ -261,7 +266,7 @@ int identity_add_fido2_parameters(
                    emoji_enabled() ? special_glyph(SPECIAL_GLYPH_TOUCH) : "",
                    emoji_enabled() ? " " : "");
 
-        r = fido_dev_make_cred(d, c, NULL);
+        r = sym_fido_dev_make_cred(d, c, NULL);
         if (r == FIDO_ERR_PIN_REQUIRED) {
                 _cleanup_free_ char *text = NULL;
 
@@ -283,7 +288,7 @@ int identity_add_fido2_parameters(
                                         continue;
                                 }
 
-                                r = fido_dev_make_cred(d, c, *i);
+                                r = sym_fido_dev_make_cred(d, c, *i);
                                 if (r == FIDO_OK) {
                                         used_pin = strdup(*i);
                                         if (!used_pin)
@@ -308,75 +313,75 @@ int identity_add_fido2_parameters(
                                        "Token action timeout. (User didn't interact with token quickly enough.)");
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to generate FIDO2 credential: %s", fido_strerr(r));
+                                       "Failed to generate FIDO2 credential: %s", sym_fido_strerr(r));
 
-        cid = fido_cred_id_ptr(c);
+        cid = sym_fido_cred_id_ptr(c);
         if (!cid)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to get FIDO2 credential ID.");
 
-        cid_size = fido_cred_id_len(c);
+        cid_size = sym_fido_cred_id_len(c);
 
-        a = fido_assert_new();
+        a = sym_fido_assert_new();
         if (!a)
                 return log_oom();
 
-        r = fido_assert_set_extensions(a, FIDO_EXT_HMAC_SECRET);
+        r = sym_fido_assert_set_extensions(a, FIDO_EXT_HMAC_SECRET);
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to enable HMAC-SECRET extension on FIDO2 assertion: %s", fido_strerr(r));
+                                       "Failed to enable HMAC-SECRET extension on FIDO2 assertion: %s", sym_fido_strerr(r));
 
-        r = fido_assert_set_hmac_salt(a, salt, FIDO2_SALT_SIZE);
+        r = sym_fido_assert_set_hmac_salt(a, salt, FIDO2_SALT_SIZE);
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to set salt on FIDO2 assertion: %s", fido_strerr(r));
+                                       "Failed to set salt on FIDO2 assertion: %s", sym_fido_strerr(r));
 
-        r = fido_assert_set_rp(a, "io.systemd.home");
+        r = sym_fido_assert_set_rp(a, "io.systemd.home");
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to set FIDO2 assertion ID: %s", fido_strerr(r));
+                                       "Failed to set FIDO2 assertion ID: %s", sym_fido_strerr(r));
 
-        r = fido_assert_set_clientdata_hash(a, (const unsigned char[32]) {}, 32);
+        r = sym_fido_assert_set_clientdata_hash(a, (const unsigned char[32]) {}, 32);
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to set FIDO2 assertion client data hash: %s", fido_strerr(r));
+                                       "Failed to set FIDO2 assertion client data hash: %s", sym_fido_strerr(r));
 
-        r = fido_assert_allow_cred(a, cid, cid_size);
+        r = sym_fido_assert_allow_cred(a, cid, cid_size);
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to add FIDO2 assertion credential ID: %s", fido_strerr(r));
+                                       "Failed to add FIDO2 assertion credential ID: %s", sym_fido_strerr(r));
 
-        r = fido_assert_set_up(a, FIDO_OPT_FALSE);
+        r = sym_fido_assert_set_up(a, FIDO_OPT_FALSE);
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to turn off FIDO2 assertion user presence: %s", fido_strerr(r));
+                                       "Failed to turn off FIDO2 assertion user presence: %s", sym_fido_strerr(r));
 
         log_info("Generating secret key on FIDO2 security token.");
 
-        r = fido_dev_get_assert(d, a, used_pin);
+        r = sym_fido_dev_get_assert(d, a, used_pin);
         if (r == FIDO_ERR_UP_REQUIRED) {
-                r = fido_assert_set_up(a, FIDO_OPT_TRUE);
+                r = sym_fido_assert_set_up(a, FIDO_OPT_TRUE);
                 if (r != FIDO_OK)
                         return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                               "Failed to turn on FIDO2 assertion user presence: %s", fido_strerr(r));
+                                               "Failed to turn on FIDO2 assertion user presence: %s", sym_fido_strerr(r));
 
                 log_notice("%s%sIn order to allow secret key generation, please verify presence on security token.",
                            emoji_enabled() ? special_glyph(SPECIAL_GLYPH_TOUCH) : "",
                            emoji_enabled() ? " " : "");
 
-                r = fido_dev_get_assert(d, a, used_pin);
+                r = sym_fido_dev_get_assert(d, a, used_pin);
         }
         if (r == FIDO_ERR_ACTION_TIMEOUT)
                 return log_error_errno(SYNTHETIC_ERRNO(ENOSTR),
                                        "Token action timeout. (User didn't interact with token quickly enough.)");
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to ask token for assertion: %s", fido_strerr(r));
+                                       "Failed to ask token for assertion: %s", sym_fido_strerr(r));
 
-        secret = fido_assert_hmac_secret_ptr(a, 0);
+        secret = sym_fido_assert_hmac_secret_ptr(a, 0);
         if (!secret)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to retrieve HMAC secret.");
 
-        secret_size = fido_assert_hmac_secret_len(a, 0);
+        secret_size = sym_fido_assert_hmac_secret_len(a, 0);
 
         r = add_fido2_credential_id(v, cid, cid_size);
         if (r < 0)
@@ -413,11 +418,15 @@ int list_fido2_devices(void) {
         fido_dev_info_t *di = NULL;
         int r;
 
-        di = fido_dev_info_new(allocated);
+        r = dlopen_libfido2();
+        if (r < 0)
+                return log_error_errno(r, "FIDO2 token support is not installed.");
+
+        di = sym_fido_dev_info_new(allocated);
         if (!di)
                 return log_oom();
 
-        r = fido_dev_info_manifest(di, allocated, &found);
+        r = sym_fido_dev_info_manifest(di, allocated, &found);
         if (r == FIDO_ERR_INTERNAL || (r == FIDO_OK && found == 0)) {
                 /* The library returns FIDO_ERR_INTERNAL when no devices are found. I wish it wouldn't. */
                 log_info("No FIDO2 devices found.");
@@ -425,7 +434,7 @@ int list_fido2_devices(void) {
                 goto finish;
         }
         if (r != FIDO_OK) {
-                r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to enumerate FIDO2 devices: %s", fido_strerr(r));
+                r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to enumerate FIDO2 devices: %s", sym_fido_strerr(r));
                 goto finish;
         }
 
@@ -438,7 +447,7 @@ int list_fido2_devices(void) {
         for (size_t i = 0; i < found; i++) {
                 const fido_dev_info_t *entry;
 
-                entry = fido_dev_info_ptr(di, i);
+                entry = sym_fido_dev_info_ptr(di, i);
                 if (!entry) {
                         r = log_error_errno(SYNTHETIC_ERRNO(EIO),
                                             "Failed to get device information for FIDO device %zu.", i);
@@ -447,9 +456,9 @@ int list_fido2_devices(void) {
 
                 r = table_add_many(
                                 t,
-                                TABLE_PATH, fido_dev_info_path(entry),
-                                TABLE_STRING, fido_dev_info_manufacturer_string(entry),
-                                TABLE_STRING, fido_dev_info_product_string(entry));
+                                TABLE_PATH, sym_fido_dev_info_path(entry),
+                                TABLE_STRING, sym_fido_dev_info_manufacturer_string(entry),
+                                TABLE_STRING, sym_fido_dev_info_product_string(entry));
                 if (r < 0) {
                         table_log_add_error(r);
                         goto finish;
@@ -465,7 +474,7 @@ int list_fido2_devices(void) {
         r = 0;
 
 finish:
-        fido_dev_info_free(&di, allocated);
+        sym_fido_dev_info_free(&di, allocated);
         return r;
 #else
         return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
@@ -482,18 +491,22 @@ int find_fido2_auto(char **ret) {
         const char *path;
         int r;
 
-        di = fido_dev_info_new(di_size);
+        r = dlopen_libfido2();
+        if (r < 0)
+                return log_error_errno(r, "FIDO2 token support is not installed.");
+
+        di = sym_fido_dev_info_new(di_size);
         if (!di)
                 return log_oom();
 
-        r = fido_dev_info_manifest(di, di_size, &found);
+        r = sym_fido_dev_info_manifest(di, di_size, &found);
         if (r == FIDO_ERR_INTERNAL || (r == FIDO_OK && found == 0)) {
                 /* The library returns FIDO_ERR_INTERNAL when no devices are found. I wish it wouldn't. */
                 r = log_error_errno(SYNTHETIC_ERRNO(ENODEV), "No FIDO2 devices found.");
                 goto finish;
         }
         if (r != FIDO_OK) {
-                r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to enumerate FIDO2 devices: %s", fido_strerr(r));
+                r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to enumerate FIDO2 devices: %s", sym_fido_strerr(r));
                 goto finish;
         }
         if (found > 1) {
@@ -501,14 +514,14 @@ int find_fido2_auto(char **ret) {
                 goto finish;
         }
 
-        entry = fido_dev_info_ptr(di, 0);
+        entry = sym_fido_dev_info_ptr(di, 0);
         if (!entry) {
                 r = log_error_errno(SYNTHETIC_ERRNO(EIO),
                                     "Failed to get device information for FIDO device 0.");
                 goto finish;
         }
 
-        path = fido_dev_info_path(entry);
+        path = sym_fido_dev_info_path(entry);
         if (!path) {
                 r = log_error_errno(SYNTHETIC_ERRNO(EIO),
                                     "Failed to query FIDO device path.");
@@ -525,7 +538,7 @@ int find_fido2_auto(char **ret) {
         r = 0;
 
 finish:
-        fido_dev_info_free(&di, di_size);
+        sym_fido_dev_info_free(&di, di_size);
         return r;
 #else
         return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
diff --git a/src/home/homework-fido2.c b/src/home/homework-fido2.c
index 2f717a5938..7c21dd34f3 100644
--- a/src/home/homework-fido2.c
+++ b/src/home/homework-fido2.c
@@ -4,6 +4,7 @@
 
 #include "hexdecoct.h"
 #include "homework-fido2.h"
+#include "libfido2-util.h"
 #include "strv.h"
 
 static int fido2_use_specific_token(
@@ -13,39 +14,39 @@ static int fido2_use_specific_token(
                 const Fido2HmacSalt *salt,
                 char **ret) {
 
-        _cleanup_(fido_cbor_info_free) fido_cbor_info_t *di = NULL;
-        _cleanup_(fido_assert_free) fido_assert_t *a = NULL;
-        _cleanup_(fido_dev_free) fido_dev_t *d = NULL;
+        _cleanup_(fido_cbor_info_free_wrapper) fido_cbor_info_t *di = NULL;
+        _cleanup_(fido_assert_free_wrapper) fido_assert_t *a = NULL;
+        _cleanup_(fido_dev_free_wrapper) fido_dev_t *d = NULL;
         bool found_extension = false;
         size_t n, hmac_size;
         const void *hmac;
         char **e;
         int r;
 
-        d = fido_dev_new();
+        d = sym_fido_dev_new();
         if (!d)
                 return log_oom();
 
-        r = fido_dev_open(d, path);
+        r = sym_fido_dev_open(d, path);
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to open FIDO2 device %s: %s", path, fido_strerr(r));
+                                       "Failed to open FIDO2 device %s: %s", path, sym_fido_strerr(r));
 
-        if (!fido_dev_is_fido2(d))
+        if (!sym_fido_dev_is_fido2(d))
                 return log_error_errno(SYNTHETIC_ERRNO(ENODEV),
                                        "Specified device %s is not a FIDO2 device.", path);
 
-        di = fido_cbor_info_new();
+        di = sym_fido_cbor_info_new();
         if (!di)
                 return log_oom();
 
-        r = fido_dev_get_cbor_info(d, di);
+        r = sym_fido_dev_get_cbor_info(d, di);
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to get CBOR device info for %s: %s", path, fido_strerr(r));
+                                       "Failed to get CBOR device info for %s: %s", path, sym_fido_strerr(r));
 
-        e = fido_cbor_info_extensions_ptr(di);
-        n = fido_cbor_info_extensions_len(di);
+        e = sym_fido_cbor_info_extensions_ptr(di);
+        n = sym_fido_cbor_info_extensions_len(di);
 
         for (size_t i = 0; i < n; i++)
                 if (streq(e[i], "hmac-secret")) {
@@ -57,49 +58,49 @@ static int fido2_use_specific_token(
                 return log_error_errno(SYNTHETIC_ERRNO(ENODEV),
                                        "Specified device %s is a FIDO2 device, but does not support the required HMAC-SECRET extension.", path);
 
-        a = fido_assert_new();
+        a = sym_fido_assert_new();
         if (!a)
                 return log_oom();
 
-        r = fido_assert_set_extensions(a, FIDO_EXT_HMAC_SECRET);
+        r = sym_fido_assert_set_extensions(a, FIDO_EXT_HMAC_SECRET);
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to enable HMAC-SECRET extension on FIDO2 assertion: %s", fido_strerr(r));
+                                       "Failed to enable HMAC-SECRET extension on FIDO2 assertion: %s", sym_fido_strerr(r));
 
-        r = fido_assert_set_hmac_salt(a, salt->salt, salt->salt_size);
+        r = sym_fido_assert_set_hmac_salt(a, salt->salt, salt->salt_size);
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to set salt on FIDO2 assertion: %s", fido_strerr(r));
+                                       "Failed to set salt on FIDO2 assertion: %s", sym_fido_strerr(r));
 
-        r = fido_assert_set_rp(a, "io.systemd.home");
+        r = sym_fido_assert_set_rp(a, "io.systemd.home");
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to set FIDO2 assertion ID: %s", fido_strerr(r));
+                                       "Failed to set FIDO2 assertion ID: %s", sym_fido_strerr(r));
 
-        r = fido_assert_set_clientdata_hash(a, (const unsigned char[32]) {}, 32);
+        r = sym_fido_assert_set_clientdata_hash(a, (const unsigned char[32]) {}, 32);
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to set FIDO2 assertion client data hash: %s", fido_strerr(r));
+                                       "Failed to set FIDO2 assertion client data hash: %s", sym_fido_strerr(r));
 
-        r = fido_assert_allow_cred(a, salt->credential.id, salt->credential.size);
+        r = sym_fido_assert_allow_cred(a, salt->credential.id, salt->credential.size);
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to add FIDO2 assertion credential ID: %s", fido_strerr(r));
+                                       "Failed to add FIDO2 assertion credential ID: %s", sym_fido_strerr(r));
 
-        r = fido_assert_set_up(a, h->fido2_user_presence_permitted <= 0 ? FIDO_OPT_FALSE : FIDO_OPT_TRUE);
+        r = sym_fido_assert_set_up(a, h->fido2_user_presence_permitted <= 0 ? FIDO_OPT_FALSE : FIDO_OPT_TRUE);
         if (r != FIDO_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to set FIDO2 assertion user presence: %s", fido_strerr(r));
+                                       "Failed to set FIDO2 assertion user presence: %s", sym_fido_strerr(r));
 
         log_info("Asking FIDO2 token for authentication.");
 
-        r = fido_dev_get_assert(d, a, NULL); /* try without pin first */
+        r = sym_fido_dev_get_assert(d, a, NULL); /* try without pin first */
         if (r == FIDO_ERR_PIN_REQUIRED) {
                 char **i;
 
                 /* OK, we needed a pin, try with all pins in turn */
                 STRV_FOREACH(i, secret->token_pin) {
-                        r = fido_dev_get_assert(d, a, *i);
+                        r = sym_fido_dev_get_assert(d, a, *i);
                         if (r != FIDO_ERR_PIN_INVALID)
                                 break;
                 }
@@ -128,14 +129,14 @@ static int fido2_use_specific_token(
                                        "Token action timeout. (User didn't interact with token quickly enough.)");
         default:
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
-                                       "Failed to ask token for assertion: %s", fido_strerr(r));
+                                       "Failed to ask token for assertion: %s", sym_fido_strerr(r));
         }
 
-        hmac = fido_assert_hmac_secret_ptr(a, 0);
+        hmac = sym_fido_assert_hmac_secret_ptr(a, 0);
         if (!hmac)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to retrieve HMAC secret.");
 
-        hmac_size = fido_assert_hmac_secret_len(a, 0);
+        hmac_size = sym_fido_assert_hmac_secret_len(a, 0);
 
         r = base64mem(hmac, hmac_size, ret);
         if (r < 0)
@@ -149,18 +150,22 @@ int fido2_use_token(UserRecord *h, UserRecord *secret, const Fido2HmacSalt *salt
         fido_dev_info_t *di = NULL;
         int r;
 
-        di = fido_dev_info_new(allocated);
+        r = dlopen_libfido2();
+        if (r < 0)
+                return log_error_errno(r, "FIDO2 support is not installed.");
+
+        di = sym_fido_dev_info_new(allocated);
         if (!di)
                 return log_oom();
 
-        r = fido_dev_info_manifest(di, allocated, &found);
+        r = sym_fido_dev_info_manifest(di, allocated, &found);
         if (r == FIDO_ERR_INTERNAL) {
                 /* The library returns FIDO_ERR_INTERNAL when no devices are found. I wish it wouldn't. */
                 r = log_debug_errno(SYNTHETIC_ERRNO(EAGAIN), "Got FIDO_ERR_INTERNAL, assuming no devices.");
                 goto finish;
         }
         if (r != FIDO_OK) {
-                r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to enumerate FIDO2 devices: %s", fido_strerr(r));
+                r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to enumerate FIDO2 devices: %s", sym_fido_strerr(r));
                 goto finish;
         }
 
@@ -168,14 +173,14 @@ int fido2_use_token(UserRecord *h, UserRecord *secret, const Fido2HmacSalt *salt
                 const fido_dev_info_t *entry;
                 const char *path;
 
-                entry = fido_dev_info_ptr(di, i);
+                entry = sym_fido_dev_info_ptr(di, i);
                 if (!entry) {
                         r = log_error_errno(SYNTHETIC_ERRNO(EIO),
                                             "Failed to get device information for FIDO device %zu.", i);
                         goto finish;
                 }
 
-                path = fido_dev_info_path(entry);
+                path = sym_fido_dev_info_path(entry);
                 if (!path) {
                         r = log_error_errno(SYNTHETIC_ERRNO(EIO),
                                             "Failed to query FIDO device path.");
@@ -192,6 +197,6 @@ int fido2_use_token(UserRecord *h, UserRecord *secret, const Fido2HmacSalt *salt
         r = -EAGAIN;
 
 finish:
-        fido_dev_info_free(&di, allocated);
+        sym_fido_dev_info_free(&di, allocated);
         return r;
 }