Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 5. Additional toolsets for development

Additional toolsets for C and C++ development provides capabilities for building, analyzing, and optimizing applications. By using these toolsets, you can define development workflows and improve application quality.

5.1. Using the GCC Toolset
Copy link

The GCC Toolset provides updated development tools on Red Hat Enterprise Linux. Install, enable, and manage the toolset to build and debug C and C++ applications.

5.1.1. What is the GCC Toolset
Copy link

Red Hat Enterprise Linux 10 introduces the GCC Toolset, which is an Application Stream that contains updated versions of development and performance analysis tools. The GCC Toolset is similar in role to Red Hat Developer Toolset.

GCC Toolset is available as an Application Stream in the form of a Software Collection in the AppStream repository. The GCC Toolset is fully supported under Red Hat Enterprise Linux Subscription Level Agreements, is functionally complete, and is intended for production use. Applications and libraries provided by the GCC Toolset do not replace the Red Hat Enterprise Linux system versions, do not override them, and do not automatically become default or preferred choices. By using a framework called Software Collections, an additional set of developer tools is installed into the /opt/ directory and is explicitly enabled by the user on-demand by using the scl utility. Unless noted otherwise for specific tools or features, the GCC Toolset is available for all architectures supported by Red Hat Enterprise Linux.

5.1.2. Installing the GCC Toolset
Copy link

Installing the GCC Toolset on a system installs the main tools and all necessary dependencies. Note that some parts of the toolset are not installed by default and must be installed separately.

Procedure

  • To install the GCC Toolset version N: 

    # dnf install gcc-toolset-N

To install only certain tools from the GCC Toolset instead of the whole toolset, list the available packages and install the selected ones with the dnf package management tool. Use selective installation to access packages not installed by default with the full toolset.

Procedure

  1. List the packages available in the GCC Toolset version N: 

    $ dnf list available gcc-toolset-N-\

  2. To install any of these packages: 

    # dnf install package_name

    Replace package_name with a space-separated list of packages to install. For example, to install the gcc-toolset-15-annobin-annocheck and gcc-toolset-15-binutils-devel packages: 

    # dnf install gcc-toolset-15-annobin-annocheck gcc-toolset-15-binutils-devel

5.1.4. Uninstalling the GCC Toolset
Copy link

Remove the GCC Toolset from your system by uninstalling it using the dnf package management tool.

Procedure

  • To uninstall the GCC Toolset version N: 

    # dnf remove gcc-toolset-N \

5.1.5. Accessing the GCC Toolset
Copy link

To access the GCC Toolset, you can run a specific tool using the scl utility, or start a shell session where the toolset versions override the system versions.

Procedure

  • To run a single tool from the GCC Toolset version N: 

    $ gcc-toolset-N-env tool

    Replace tool with the command provided by the tool you want to run.

  • To run a shell session where tool versions from the GCC Toolset version N override system versions of these tools: 

    $ gcc-toolset-N-env bash
    Note

    The scl utility is not used for the GCC Toolset in Red Hat Enterprise Linux 10. The scl enable command does not work with the GCC Toolset.

5.2. GCC Toolset 15
Copy link

GCC Toolset 15 in Red Hat Enterprise Linux offers updated compilers and debuggers for C, C++, and Fortran. It enables building, testing, and optimizing applications with current features while maintaining system stability and support.

5.2.1. The GCC Toolset 15 tools and versions
Copy link

The GCC Toolset 15 offers updated versions of development tools for building and debugging applications on RHEL.

  • [list of tools]
Expand
Table 5.1. Tool versions in the GCC Toolset 15

Name

Version

Description

GCC

15.1.0

A portable compiler suite with support for C, C++, and Fortran.

binutils

2.44

A collection of binary tools and other utilities to inspect and manipulate object files and binaries.

dwz

0.16

A tool to optimize DWARF debugging information contained in ELF shared libraries and ELF executables for size.

5.2.2. C++ compatibility in the GCC Toolset 15
Copy link

GCC Toolset 15 supports a range of C++ language standards. The default standard is C++17, but you can choose C++98, C++11, C++14, or experimental versions including C++20, C++23, and C++26. Select a different standard with the appropriate compiler flag when building your code.

Important

This compatibility information applies only to GCC from the GCC Toolset 15.

The GCC compiler in the GCC Toolset 15 can use the following C++ standards:

C++98
This language standard is available in the GCC Toolset 15. Binaries, shared libraries, and objects built using this standard can be freely mixed regardless of being built with GCC from the GCC Toolset 15, Red Hat Developer Toolset, and RHEL 5, 6, 7, and 8.
C++11

This language standard is available in the GCC Toolset 15.

Using the C++11 language version is supported when all C++ objects compiled with the corresponding flag have been built using GCC version 5 or later.

C++14

This language standard is available in the GCC Toolset 15.

Using the C++14 language version is supported when all C++ objects compiled with the corresponding flag have been built using GCC version 6 or later.

C++17

This language standard is available in the GCC Toolset 15.

This is the default language standard setting for the GCC Toolset 15, with GNU extensions, equivalent to explicitly using option -std=gnu++17.

Using the C++17 language version is supported when all C++ objects compiled with the corresponding flag have been built using GCC version 10 or later.

C++20, C++23, and C++26

These language standards are available in the GCC Toolset 15 only as experimental, unstable, and unsupported capabilities. Additionally, the compatibility of objects, binary files, and libraries built using these standards cannot be guaranteed.

To enable the C++20 standard, add the command-line option -std=c++20 to your g++ command line.

To enable the C++23 standard, add the command-line option -std=c++23 to your g++ command line.

To enable the C++26 standard, add the command-line option -std=c++26 to your g++ command line.

All of the language standards are available in both the standard-compliant variant and with GNU extensions.

Use the GCC Toolset 15 for linking when you combine objects built with the GCC Toolset 15 and objects built with the system toolchain, particulary .o or .a files. This ensures any newer library features provided only by the GCC Toolset 15 are resolved at link time.

5.2.3. Specifics of GCC in the GCC Toolset 15
Copy link

Certain behaviors and requirements of binutils in the GCC Toolset 15 differ from the base Red Hat Enterprise Linux binutils. These include automatic static linking of certain library features and the requirement to specify libraries after object files during linking.

Static linking of libraries
Certain more recent library features are statically linked into applications built with the GCC Toolset 15 to support execution on multiple versions of Red Hat Enterprise Linux. This creates an additional minor security risk because standard Red Hat Enterprise Linux errata do not change this code. If the need arises for developers to rebuild their applications due to this risk, Red Hat will communicate this using a security erratum.
Important

Because of this additional security risk, developers are strongly advised not to statically link their entire application for the same reasons.

Specify libraries after object files when linking

In the GCC Toolset 15, libraries are linked by using linker scripts, which might specify some symbols through static archives. This is required to ensure compatibility with multiple versions of Red Hat Enterprise Linux. However, the linker scripts use the names of the corresponding shared object files. As a consequence, the linker uses different symbol handling rules than expected, and does not recognize symbols required by object files when the option adding the library is specified before options specifying the object files: 

$ gcc-toolset-15-env gcc -lsomelib objfile.o

Using a library from the GCC Toolset 15 in this manner results in the linker error message undefined reference to symbol. To prevent this problem, follow the standard linking practice and specify the option by adding the library after the options specifying the object files: 

$ gcc-toolset-15-env gcc objfile.o -lsomelib

Note that this recommendation also applies when using the base Red Hat Enterprise Linux version of GCC.

5.2.4. Specifics of binutils in the GCC Toolset 15
Copy link

Certain behaviors and requirements of binutils in the GCC Toolset 15 differ from the base Red Hat Enterprise Linux binutils. These include automatic static linking of certain library features and the requirement to specify libraries after object files during linking.

Static linking of libraries
GCC Toolset 15 statically links newer library features into applications to ensure compatibility across multiple Red Hat Enterprise Linux versions. Statically linked code can introduce minor security risks, because security updates require applications to be rebuilt. If a security vulnerability is discovered, Red Hat will notify developers to rebuild affected applications through a security advisory.
Important

Because of this additional security risk, developers are strongly advised not to statically link their entire application for the same reasons.

Specify libraries after object files when linking

In the GCC Toolset 15, libraries are linked by using linker scripts which might specify some symbols through static archives. This is required to ensure compatibility with multiple versions of Red Hat Enterprise Linux. However, the linker scripts use the names of the corresponding shared object files. As a consequence, the linker uses different symbol handling rules than expected, and does not recognize symbols required by object files when the option adding the library is specified before options specifying the object files: 

$ gcc-toolset-15-env gcc ld -lsomelib objfile.o

Using a library from the GCC Toolset 15 in this manner results in the linker error message undefined reference to symbol. To prevent this problem, follow the standard linking practice, and specify the option adding the library after the options specifying the object files: 

$ gcc-toolset-15-env ld objfile.o -lsomelib

Note that this recommendation also applies when using the base Red Hat Enterprise Linux version of binutils.

5.3. Compiler toolsets
Copy link

RHEL 10 provides several compiler toolsets as Application Streams, including the LLVM Toolset, Rust Toolset, and Go Toolset. These toolsets provides compilers, debuggers, dependency managers, and other related tools and libraries for C, C++, Rust, and Go development.

The following compiler toolsets are available:

  • LLVM Toolset provides the LLVM compiler infrastructure framework, the Clang compiler for the C and C++ languages, the LLDB debugger, and related tools for code analysis.
  • Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, the cargo-vendor plug-in, and required libraries.
  • Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

For more details and information about usage, see the compiler toolsets user guides on the Red Hat Developer Tools page.

5.4. The Annobin project
Copy link

Use the Annobin project to add markers to Executable and Linkable Format (ELF) objects. With the Annobin project, you can track build properties and perform security hardening checks on your binaries by using the annobin plugin and the annocheck programs.

The annobin plugin scans the GNU Compiler Collection (GCC) command line, the compilation state, and the compilation process, and generates the ELF notes. The ELF notes record how the binary was built and provide information for the annocheck program to perform security hardening checks.

The security hardening checker is part of the annocheck program and is enabled by default. It checks the binary files to determine whether the program was built with necessary security hardening options and compiled correctly. annocheck is able to recursively scan directories, archives, and RPM packages for ELF object files.

Note

The files must be in ELF format. annocheck does not handle any other binary file types.

You can perform following tasks:

  • Use the annobin plugin
  • Use the annocheck program
  • Remove redundant annobin notes

5.4.1. Using the annobin plugin
Copy link

You can use the annobin plugin to annotate binary files. You can enable the annobin plugin and pass options to it.

5.4.1.1. Enabling the annobin plug-in
Copy link

To add build security notes to binaries, enable the annobin plug-in by using command-line options with gcc or clang utilities.

Procedure

  • To enable the annobin plug-in with gcc, use: 

    $ gcc -fplugin=annobin

    • If gcc does not find the annobin plug-in, use: 

      $ gcc -iplugindir=/path/to/directory/containing/annobin/

      Replace /path/to/directory/containing/annobin/ with the absolute path to the directory that contains annobin.

    • To find the directory containing the annobin plug-in, use: 

      $ gcc --print-file-name=plugin

  • To enable the annobin plug-in with clang, use: 

    $ clang -fplugin=/path/to/directory/containing/annobin/

    Replace /path/to/directory/containing/annobin/ with the absolute path to the directory that contains annobin.

  • Optional: To remove the redundant annobin notes, use the objcopy utility: 

    $ objcopy --merge-notes file-name

5.4.1.2. Passing options to the annobin plug-in
Copy link

To pass options to the annobin plug-in, use the appropriate command-line arguments with gcc or clang.

Procedure

  • To pass options to the annobin plug-in with gcc, use: 

    $ gcc -fplugin=annobin -fplugin-arg-annobin-option file-name

    Replace option with the annobin command line arguments and replace file-name with the name of the file.

    • For example, to display additional details about what annobin it is doing, use: 

      $ gcc -fplugin=annobin -fplugin-arg-annobin-verbose file-name

      Replace file-name with the name of the file.

  • To pass options to the annobin plug-in with clang, use: 

    $ clang -fplugin=/path/to/directory/containing/annobin/ -Xclang -plugin-arg-annobin -Xclang option file-name

    Replace option with the annobin command line arguments and replace /path/to/directory/containing/annobin/ with the absolute path to the directory containing annobin.

    • For example, to display additional details about what annobin it is doing, use: 

      $ clang -fplugin=/usr/lib64/clang/10/lib/annobin.so -Xclang -plugin-arg-annobin -Xclang verbose file-name

      Replace file-name with the name of the file.

5.4.2. Using the annocheck program
Copy link

You can use annocheck to examine files, directories, RPM packages, and extra tools.

Note

annocheck recursively scans directories, archives, and RPM packages for ELF object files. The files have to be in the ELF format. annocheck does not handle any other binary file types.

5.4.2.1. Using annocheck to examine files
Copy link

To verify hardening options and build security notes of ELF files, examine the files by using the annocheck tool.

Procedure

  • To examine a file, use: 

    $ annocheck file-name

    Replace file-name with the name of a file.

    Note

    The files must be in ELF format. annocheck does not handle any other binary file types. annocheck processes static libraries that contain ELF object files.

5.4.2.2. Using annocheck to examine directories
Copy link

To examine ELF files in a directory, use the annocheck tool, which recursively scans directories, subdirectories, and archives.

Procedure

  • To scan a directory, use: 

    $ annocheck directory-name

    Replace directory-name with the name of a directory. annocheck automatically examines the contents of the directory, its sub-directories, and any archives and RPM packages within the directory.

    Note

    annocheck only looks for ELF files. Other file types are ignored.

5.4.2.3. Using annocheck to examine RPM packages
Copy link

To examine ELF files in an RPM package, use the annocheck tool, which recursively scans all ELF files inside the package.

Procedure

  • To scan an RPM package, use: 

    $ annocheck rpm-package-name

    Replace rpm-package-name with the name of an RPM package. annocheck recursively scans all the ELF files inside the RPM package.

    Note

    annocheck only looks for ELF files. Other file types are ignored.

  • To scan an RPM package with provided debug info RPM, use: 

    $ annocheck rpm-package-name --debug-rpm debuginfo-rpm

    Replace rpm-package-name with the name of an RPM package, and debuginfo-rpm with the name of a debug info RPM associated with the binary RPM.

5.4.2.4. Using annocheck extra tools
Copy link

The annocheck utility includes multiple tools for examining binary files, which you can enable by using command-line options.

The following section describes how to enable the:

  • built-by tool
  • notes tool
  • section-size tool

You can enable multiple tools at the same time.

Note

The hardening checker is enabled by default.

5.4.2.4.1. Enabling the built-by tool
Copy link

To find the name of the compiler that built a specific binary file, you can use the annocheck built-by tool.

Procedure

  • To enable the built-by tool, use: 

    $ annocheck --enable-built-by

    For more information about the built-by tool, see the --help command-line option.

5.4.2.4.2. Enabling the notes tool
Copy link

To display the notes stored inside a binary file created by the annobin plug-in, you can use the annocheck notes tool.

Procedure

  • To enable the notes tool, use: 

    $ annocheck --enable-notes

    The notes are displayed in a sequence sorted by the address range. For more information about the notes tool, see the --help command-line option.

5.4.2.4.3. Enabling the section-size tool
Copy link

To display the size of named sections, you can use the annocheck section-size tool.

Procedure

  • To enable the section-size tool, use: 

    $ annocheck --section-size=name

    Replace name with the name of the named section. The output is restricted to specific sections. A cumulative result is produced at the end. For more information about the section-size tool, see the --help command-line option.

5.4.2.4.4. Hardening checker basics
Copy link

The hardening checker is enabled by default. You can disable the hardening checker by using the --disable-hardened command-line option.

5.4.2.4.4.1. Hardening checker options
Copy link

The annocheck tool verifies binaries for various hardening options, such as stack protection, PIC/PIE usage, and secure linker settings.

The following options are checked:

  • Lazy binding is disabled using the -z now linker option.
  • The program does not have a stack in an executable region of memory.
  • The relocations for the GOT table are set to read only.
  • No program segment has all three of the read, write and execute permission bits set.
  • There are no relocations against executable code.
  • The runpath information for locating shared libraries at runtime includes only directories rooted at /usr.
  • The program was compiled with annobin notes enabled.
  • The program was compiled with the -fstack-protector-strong option enabled.
  • The program was compiled with -D_FORTIFY_SOURCE=2.
  • The program was compiled with -D_GLIBCXX_ASSERTIONS.
  • The program was compiled with -fexceptions enabled.
  • The program was compiled with -fstack-clash-protection enabled.
  • The program was compiled at -O2 or higher.
  • The program does not have any relocations held in a writeable.
  • Dynamic executables have a dynamic segment.
  • Shared libraries were compiled with -fPIC or -fPIE.
  • Dynamic executables were compiled with -fPIE and linked with -pie.
  • If available, the -fcf-protection=full option was used.
  • If available, the -mbranch-protection option was used.
  • If available, the -mstackrealign option was used.
5.4.2.4.4.2. Disabling the hardening checker
Copy link

To skip security checks during binary analysis, disable the hardening checker by using the annocheck utility.

Procedure

  • To scan the notes in a file without the hardening checker, use: 

    $ annocheck --enable-notes --disable-hardened file-name

    Replace file-name with the name of a file.

5.4.3. Removing redundant annobin notes
Copy link

Using annobin increases the size of binaries. To reduce the size of the binaries compiled with annobin, use the objcopy program, which is a part of the binutils package.

Procedure

  • To remove the redundant annobin notes, use: 

    $ objcopy --merge-notes file-name

    Replace file-name with the name of the file.

Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top