badfuncs:
allowed:
/usr/lib*/libipset.so.*:
# Upstream maintainer deliberately chose this over getaddrinfo, see
# commit c52cf6000923b ("Use gethostbyname2 instead of getaddrinfo")
- gethostbyname2