annocheck man page

annocheck — Analysing an application's compilation.

Synopsis

annocheck
 [--help]
 [--version]
 [--verbose]
 [--quiet]
 [--ignore-unknown]
 [--debug-rpm=file]
 [--dwarf-dir=dir]
 [--prefix=text]
 file...

annocheck
 [--skip-bind-now]
 [--skip-cf-protection]
 [--skip-dynamic-segment]
 [--skip-fortify]
 [--skip-glibcxx-assertions]
 [--skip-gnu-relro]
 [--skip-gnu-stack]
 [--skip-optimization]
 [--skip-pic]
 [--skip-run-path]
 [--skip-rwx-seg]
 [--skip-stack-clash]
 [--skip-stack-prot]
 [--skip-stack-realign]
 [--skip-textrel]
 [--skip-threads]
 [--skip-writeable-got]
 [--ignore-gaps]
 [--disable-hardened]
 [--enable-hardened]
 file...

annocheck
 [--all]
 [--tool=name]
 [--nottool=name]
 file...

Description

The annocheck program can analyse programs and report information about them.  It is designed to be modular, with a set of self-contained tools providing the checking functionality. Currently the following tools are implemented:

The annocheck program is able to scan inside rpm files and libraries.  It will automatically recurse into any directories that are specified on the command line.  In addition annocheck knows how to find debug information held in separate debug files, and it will search for these whenever it is checking debug information.

The program supports some generic command line options that are used regardless of which tools are enabled.

"--debug-rpm=file"

Look in file for separate dwarf debug information.

"--dwarf-dir=dir"

Look in dir for separate dwarf debug information files.

"--help"

Display this message & exit.

"--ignore-unknown"

Do not complain about unknown file types.

"--prefix=text"

Include text in the output description.

"--quiet"

Do not print anything, just return an exit status.

"--verbose"

Produce informational messages whilst working.  Repeat for more information.

"--version"

Report the version of the tool and then exit.

The "hardened" tool checks that the specified files were compiled with the required security hardening options, as outlined in the elf-policy document.  It runs a series of tests checking compilation options and link time options.  These tests are outlined below, along with the command line option that can be used to disable each test.

"BIND_NOW"

Lazy binding must not have been enabled via the linker option -z now. Disabled by --skip-bind-now.

"Non executable stack"

The program must not have a stack in an executable region of memory. Disabled by --skip-gnu-stack.

"Safe GOT relocations"

The relocations for the GOT table must be read only. Disabled by --skip-writeable-got.

"No WX segments."

No program segment should have all three of the read, write and execute permission bits set. Disabled by --skip-rwx-seg.

"No text relocations"

The should be no relocations against executable code. Disabled by --skip-textrel.

"Correct runpaths"

The runpath information used to locate shared libraries at runtime must only include directories rooted at /usr. Disabled by --skip-run-path.

"Missing annobin data"

The program must have been compiled with annobin notes enabled. Disabled by --ignore-gaps.

"Strong stack protection"

The program must have been compiled with the -fstack-protector-strong option enabled, and with -D_FORTIFY_SOURCE=2 specified.  It must also have been compiled at at least optimization level 2. Disabled by --skip-stack-prot.

"Dynamic data present"

Dynamic executables must have a dynamic segment. Disabled by --skip-dynamic-segment.

"Position Independent compilation"

Shared libraries must have been compiled with -fPIE and dynamic executables must have been compiled with -fPIC. Disabled by --skip-pic.

"Safe exceptions"

Program which use exception handling must have been compiled with -fexceptions enabled and with -D_GLIBCXX_ASSERTIONS specified. Disabled by --skip-threads and/or --skip-glibcxx-assertions.

"Stack Clash protection"

If available the -fstack-clash-protection must have been used. Disabled by --skip-stack-clash.

"Control Flow protection"

If available the -fcf-protection=full must have been used. Disabled by --skip-cf-protection.

"Stack realignment"

For i686 binaries, the -mstackrealign option must have been specified. Disabled by --skip-stack-realign.

"Source fortification"

The program must have been compiled with the -D_FORTIFY_SOURCE=2 command line option specified. Disabled by --skip-fortify.

"Optimization"

The program must have been compiled with at least -O2 optimization enabled. Disabled by --skip-optimization.

"Read only relocations"

The program must not have any relocations that are held in a writeable section. Disabled by --skip-gnu-relro.

The tool does support a couple of other command line options as well:

"--enable-hardened"

Enable the tool if it was previously disabled.

"--disable-hardened"

Disable the tool.

The built-by tool is disabled by default, but it can be enabled by the command line option --enable-builtby.  The tool checks the specified files to see if any information is stored about how the file was built.

The tool supports a few command line options to customise its behaviour:

"--all"

Report all builder identification strings.  The tool has several different heuristics for determining the builder.  By default it will report the information return by the first successful heuristic.  If the --all option is enabled then all successful results will be returned.

"--tool=name"

This option can be used to restrict the output to only those files which were built by a specific tool.  This can be useful when scanning a directory full of files searching for those built by a particular compiler.

"--nottool=NAME"

This option can be used to restrict the output to only those files which were not built by a specific tool.  This can be useful when scanning a directory full of files searching for those that were not built by a particular compiler.

Options

Info

2018-06-25 annobin-1 RPM Development Tools