Use the annobin plugin

You can use the annobin plugin to annotate binary files. You can enable the annobin plugin and pass options to it.

Enable the annobin plug-in
Copy link

To add build security notes to binaries, enable the annobin plug-in by using command-line options with gcc or clang utilities.

Procedure
Copy link

  • To enable the annobin plug-in with gcc, use: 
    $ gcc -fplugin=annobin
    • If gcc does not find the annobin plug-in, use: 
      $ gcc -iplugindir=/path/to/directory/containing/annobin/

      Replace /path/to/directory/containing/annobin/ with the absolute path to the directory that contains annobin.

    • To find the directory containing the annobin plug-in, use: 
      $ gcc --print-file-name=plugin
  • To enable the annobin plug-in with clang, use: 
    $ clang -fplugin=/path/to/directory/containing/annobin/

    Replace /path/to/directory/containing/annobin/ with the absolute path to the directory that contains annobin.

  • Optional: To remove the redundant annobin notes, use the objcopy utility: 
    $ objcopy --merge-notes file-name

Pass options to the annobin plug-in
Copy link

To pass options to the annobin plug-in, use the appropriate command-line arguments with gcc or clang.

Procedure
Copy link

  • To pass options to the annobin plug-in with gcc, use: 
    $ gcc -fplugin=annobin -fplugin-arg-annobin-option file-name

    Replace option with the annobin command line arguments and replace file-name with the name of the file.

    • For example, to display additional details about what annobin it is doing, use: 
      $ gcc -fplugin=annobin -fplugin-arg-annobin-verbose file-name

      Replace file-name with the name of the file.

  • To pass options to the annobin plug-in with clang, use: 
    $ clang -fplugin=/path/to/directory/containing/annobin/ -Xclang -plugin-arg-annobin -Xclang option file-name

    Replace option with the annobin command line arguments and replace /path/to/directory/containing/annobin/ with the absolute path to the directory containing annobin.

    • For example, to display additional details about what annobin it is doing, use: 
      $ clang -fplugin=/usr/lib64/clang/10/lib/annobin.so -Xclang -plugin-arg-annobin -Xclang verbose file-name

      Replace file-name with the name of the file.