5.4. The Annobin project


Use the Annobin project to add markers to Executable and Linkable Format (ELF) objects. With the Annobin project, you can track build properties and perform security hardening checks on your binaries by using the annobin plugin and the annocheck programs.

The annobin plugin scans the GNU Compiler Collection (GCC) command line, the compilation state, and the compilation process, and generates the ELF notes. The ELF notes record how the binary was built and provide information for the annocheck program to perform security hardening checks.

The security hardening checker is part of the annocheck program and is enabled by default. It checks the binary files to determine whether the program was built with necessary security hardening options and compiled correctly. annocheck is able to recursively scan directories, archives, and RPM packages for ELF object files.

注意

The files must be in ELF format. annocheck does not handle any other binary file types.

You can perform following tasks:

  • Use the annobin plugin
  • Use the annocheck program
  • Remove redundant annobin notes

5.4.1. Using the annobin plugin

You can use the annobin plugin to annotate binary files. You can enable the annobin plugin and pass options to it.

5.4.1.1. Enabling the annobin plug-in

To add build security notes to binaries, enable the annobin plug-in by using command-line options with gcc or clang utilities.

Procedure

  • To enable the annobin plug-in with gcc, use:

    $ gcc -fplugin=annobin
    • If gcc does not find the annobin plug-in, use:

      $ gcc -iplugindir=/path/to/directory/containing/annobin/

      Replace /path/to/directory/containing/annobin/ with the absolute path to the directory that contains annobin.

    • To find the directory containing the annobin plug-in, use:

      $ gcc --print-file-name=plugin
  • To enable the annobin plug-in with clang, use:

    $ clang -fplugin=/path/to/directory/containing/annobin/

    Replace /path/to/directory/containing/annobin/ with the absolute path to the directory that contains annobin.

  • Optional: To remove the redundant annobin notes, use the objcopy utility:

    $ objcopy --merge-notes file-name

5.4.1.2. Passing options to the annobin plug-in

To pass options to the annobin plug-in, use the appropriate command-line arguments with gcc or clang.

Procedure

  • To pass options to the annobin plug-in with gcc, use:

    $ gcc -fplugin=annobin -fplugin-arg-annobin-option file-name

    Replace option with the annobin command line arguments and replace file-name with the name of the file.

    • For example, to display additional details about what annobin it is doing, use:

      $ gcc -fplugin=annobin -fplugin-arg-annobin-verbose file-name

      Replace file-name with the name of the file.

  • To pass options to the annobin plug-in with clang, use:

    $ clang -fplugin=/path/to/directory/containing/annobin/ -Xclang -plugin-arg-annobin -Xclang option file-name

    Replace option with the annobin command line arguments and replace /path/to/directory/containing/annobin/ with the absolute path to the directory containing annobin.

    • For example, to display additional details about what annobin it is doing, use:

      $ clang -fplugin=/usr/lib64/clang/10/lib/annobin.so -Xclang -plugin-arg-annobin -Xclang verbose file-name

      Replace file-name with the name of the file.

Red Hat logoGithubredditYoutubeTwitter

学习

尝试、购买和销售

社区

關於紅帽

我们提供强化的解决方案,使企业能够更轻松地跨平台和环境(从核心数据中心到网络边缘)工作。

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情,请参阅红帽博客.

关于红帽文档

Legal Notice

Theme

© 2026 Red Hat
返回顶部