badfuncs:
  allowed:
    /usr/lib*/libipset.so.*:
      # Upstream maintainer deliberately chose this over getaddrinfo, see
      # commit c52cf6000923b ("Use gethostbyname2 instead of getaddrinfo")
      - gethostbyname2