We do a lot of static linking in ThinLinc in order to avoid dependencies on the host system. It however has a certain risk of loading runtime .so files from the system and them getting confused by the symbols included in our binaries. Examples of when this can happen is nss modules, and FLTK can these days load GTK+ in order to display that native file chooser. To avoid (or at least mitigate) this issue, we should make sure that we do not export any symbols from our files except when absolutely necessary. --exclude-libs ALL can most likely achieve what we want. We might also want to double check that we link in a way that we don't use any replaced symbols ourselves. For shared libraries this is controlled by -Bsymbolic. Might need another flag for executables.
Another case is when we load a PKCS#11 module.
