5.4. The Annobin project
Use the Annobin project to add markers to Executable and Linkable Format (ELF) objects. With the Annobin project, you can track build properties and perform security hardening checks on your binaries by using the annobin plugin and the annocheck programs.
The annobin plugin scans the GNU Compiler Collection (GCC) command line, the compilation state, and the compilation process, and generates the ELF notes. The ELF notes record how the binary was built and provide information for the annocheck program to perform security hardening checks.
The security hardening checker is part of the annocheck program and is enabled by default. It checks the binary files to determine whether the program was built with necessary security hardening options and compiled correctly. annocheck is able to recursively scan directories, archives, and RPM packages for ELF object files.
The files must be in ELF format. annocheck does not handle any other binary file types.
You can perform following tasks:
-
Use the
annobinplugin -
Use the
annocheckprogram -
Remove redundant
annobinnotes
5.4.1. Using the annobin plugin 复制链接链接已复制到粘贴板!
You can use the annobin plugin to annotate binary files. You can enable the annobin plugin and pass options to it.
5.4.1.1. Enabling the annobin plug-in 复制链接链接已复制到粘贴板!
To add build security notes to binaries, enable the annobin plug-in by using command-line options with gcc or clang utilities.
Procedure
To enable the
annobinplug-in withgcc, use:$ gcc -fplugin=annobinIf
gccdoes not find theannobinplug-in, use:$ gcc -iplugindir=/path/to/directory/containing/annobin/Replace /path/to/directory/containing/annobin/ with the absolute path to the directory that contains
annobin.To find the directory containing the
annobinplug-in, use:$ gcc --print-file-name=plugin
To enable the
annobinplug-in withclang, use:$ clang -fplugin=/path/to/directory/containing/annobin/Replace /path/to/directory/containing/annobin/ with the absolute path to the directory that contains
annobin.Optional: To remove the redundant
annobinnotes, use theobjcopyutility:$ objcopy --merge-notes file-name
5.4.1.2. Passing options to the annobin plug-in 复制链接链接已复制到粘贴板!
To pass options to the annobin plug-in, use the appropriate command-line arguments with gcc or clang.
Procedure
To pass options to the
annobinplug-in withgcc, use:$ gcc -fplugin=annobin -fplugin-arg-annobin-option file-nameReplace option with the
annobincommand line arguments and replace file-name with the name of the file.For example, to display additional details about what
annobinit is doing, use:$ gcc -fplugin=annobin -fplugin-arg-annobin-verbose file-nameReplace file-name with the name of the file.
To pass options to the
annobinplug-in withclang, use:$ clang -fplugin=/path/to/directory/containing/annobin/ -Xclang -plugin-arg-annobin -Xclang option file-nameReplace option with the
annobincommand line arguments and replace /path/to/directory/containing/annobin/ with the absolute path to the directory containingannobin.For example, to display additional details about what
annobinit is doing, use:$ clang -fplugin=/usr/lib64/clang/10/lib/annobin.so -Xclang -plugin-arg-annobin -Xclang verbose file-nameReplace file-name with the name of the file.