.\" ========================================================================
.\"
.IX Title "ANNOBIN 1"
-.TH ANNOBIN 1 "2018-04-20" "annobin-1" "RPM Development Tools"
+.TH ANNOBIN 1 "2018-05-31" "annobin-1" "RPM Development Tools"
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
* Menu:
-* Who Built Me:: The built-by.sh script
-* ABI Checking:: The check-abi.sh script
-* Hardening Checks:: The hardened.sh script
-* Checking Archives:: The run-on-binaries-in.sh script
+* Who Built Me:: The built-by script
+* ABI Checking:: The check-abi script
+* Hardening Checks:: The hardened script
+* Checking Archives:: The run-on-binaries-in script
\1f
File: annobin.info, Node: Who Built Me, Next: ABI Checking, Up: Using
-4.1 The built-by.sh script
-==========================
+4.1 The built-by script
+=======================
- built-by.sh
+ built-by
[-help]
[-version]
[-verbose]
[-]
FILE...
- The 'built-by.sh' script reports the name and version of the tool
-used to build the specified file(s). This script also demonstrates how
+ The 'built-by' script reports the name and version of the tool used
+to build the specified file(s). This script also demonstrates how
information can be extracted from other other locations in the file, not
just the binary annotation notes.
\1f
File: annobin.info, Node: ABI Checking, Next: Hardening Checks, Prev: Who Built Me, Up: Using
-4.2 The check-abi.sh script
-===========================
+4.2 The check-abi script
+========================
- check-abi.sh
+ check-abi
[-help]
[-version]
[-verbose]
[-]
FILE...
- The 'check-abi.sh' script reports any potential ABI conflicts in the
+ The 'check-abi' script reports any potential ABI conflicts in the
files specified. This includes the use of the '-fshort-enums' option,
the '-fstack-protector' option and the '-D_FORTIFY_SOURCE' option. All
of these can affect passing data between functions and hence should be
\1f
File: annobin.info, Node: Hardening Checks, Next: Checking Archives, Prev: ABI Checking, Up: Using
-4.3 The hardened.sh script
-==========================
+4.3 The hardened script
+=======================
- hardened.sh
+ hardened
[-help]
[-version]
[-verbose]
[-]
FILE...
- The 'hardened.sh' script reports on the hardening status of the
+ The 'hardened' script reports on the hardening status of the
specified file(s). In particular it checks that the whole file was
compiled with '-O2' or higher and the '-fstack-protector-strong',
'-D_FORTIFY_SOURCE=2', '-Wl,-z,now', '-Wl,-z,relro', '-fPIE',
\1f
File: annobin.info, Node: Checking Archives, Prev: Hardening Checks, Up: Using
-4.4 The run-on-binaries-in.sh script
-====================================
+4.4 The run-on-binaries-in script
+=================================
- run-on-binaries-in.sh
+ run-on-binaries-in
[-help]
[-version]
[-verbose]
[program-options]
FILE...
- The 'run-on-binaries-in.sh' script allows other scripts, or programs,
-to be run on the executable files contained inside archives. This
-includes 'rpm' files, 'tar' and 'ar' files and compressed files.
+ The 'run-on-binaries-in' script allows other scripts, or programs, to
+be run on the executable files contained inside archives. This includes
+'rpm' files, 'tar' and 'ar' files and compressed files.
The script does not recurse into directories, but this can be handled
by the 'find' command, like this:
- find . -type f -exec run-on-binaries-in.sh <script-to-run> {} \;
+ find . -type f -exec run-on-binaries-in <script-to-run> {} \;
The script accepts the following command line options:
Node: The CET Encoding\7f14470
Node: The ENUM Encoding\7f15264
Node: Using\7f15621
-Node: Who Built Me\7f16136
-Node: ABI Checking\7f18899
-Node: Hardening Checks\7f21016
-Node: Checking Archives\7f25105
-Node: GNU FDL\7f27533
+Node: Who Built Me\7f16124
+Node: ABI Checking\7f18875
+Node: Hardening Checks\7f20980
+Node: Checking Archives\7f25057
+Node: GNU FDL\7f27470
\1f
End Tag Table
demonstrate how the binary information can be used. The scripts are:
@menu
-* Who Built Me:: The built-by.sh script
-* ABI Checking:: The check-abi.sh script
-* Hardening Checks:: The hardened.sh script
-* Checking Archives:: The run-on-binaries-in.sh script
+* Who Built Me:: The built-by script
+* ABI Checking:: The check-abi script
+* Hardening Checks:: The hardened script
+* Checking Archives:: The run-on-binaries-in script
@end menu
@c -----------------------------------------------------------------
@node Who Built Me
-@section The built-by.sh script
+@section The built-by script
@c man title built-by Who Built Me
@smallexample
@c man begin SYNOPSIS built-by
-built-by.sh
+built-by
[@b{--help}]
[@b{--version}]
[@b{--verbose}]
@c man begin DESCRIPTION built-by
-The @file{built-by.sh} script reports the name and version of the tool
+The @file{built-by} script reports the name and version of the tool
used to build the specified file(s). This script also demonstrates
how information can be extracted from other other locations in the
file, not just the binary annotation notes.
@c -----------------------------------------------------------------
@node ABI Checking
-@section The check-abi.sh script
+@section The check-abi script
@c man title check-abi ABI Checking
@smallexample
@c man begin SYNOPSIS check-abi
-check-abi.sh
+check-abi
[@b{--help}]
[@b{--version}]
[@b{--verbose}]
@c man begin DESCRIPTION check-abi
-The @file{check-abi.sh} script reports any potential ABI conflicts in
+The @file{check-abi} script reports any potential ABI conflicts in
the files specified. This includes the use of the
@option{-fshort-enums} option, the @option{-fstack-protector} option
and the @option{-D_FORTIFY_SOURCE} option. All of these can affect
@c -----------------------------------------------------------------
@node Hardening Checks
-@section The hardened.sh script
+@section The hardened script
@c man title hardened Hardening Checks
@smallexample
@c man begin SYNOPSIS hardened
-hardened.sh
+hardened
[@b{--help}]
[@b{--version}]
[@b{--verbose}]
@c man begin DESCRIPTION hardened
-The @file{hardened.sh} script reports on the hardening status of the
+The @file{hardened} script reports on the hardening status of the
specified file(s). In particular it checks that the whole file was
compiled with @option{-O2} or higher and the
@option{-fstack-protector-strong}, @option{-D_FORTIFY_SOURCE=2},
@c -----------------------------------------------------------------
@node Checking Archives
-@section The run-on-binaries-in.sh script
+@section The run-on-binaries-in script
@c man title run-on-binries Checking Archives
@smallexample
@c man begin SYNOPSIS run-on-binaries
-run-on-binaries-in.sh
+run-on-binaries-in
[@b{--help}]
[@b{--version}]
[@b{--verbose}]
@c man begin DESCRIPTION run-on-binaries
-The @file{run-on-binaries-in.sh} script allows other scripts, or
+The @file{run-on-binaries-in} script allows other scripts, or
programs, to be run on the executable files contained inside archives.
This includes @samp{rpm} files, @samp{tar} and @samp{ar} files and
compressed files.
by the @code{find} command, like this:
@smallexample
- find . -type f -exec run-on-binaries-in.sh <script-to-run> @{@} \;
+ find . -type f -exec run-on-binaries-in <script-to-run> @{@} \;
@end smallexample
The script accepts the following command line options:
.\" ========================================================================
.\"
.IX Title "BUILT-BY 1"
-.TH BUILT-BY 1 "2018-04-20" "annobin-1" "RPM Development Tools"
+.TH BUILT-BY 1 "2018-05-31" "annobin-1" "RPM Development Tools"
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
built\-by \- Who Built Me
.SH "SYNOPSIS"
.IX Header "SYNOPSIS"
-built\-by.sh
+built-by
[\fB\-\-help\fR]
[\fB\-\-version\fR]
[\fB\-\-verbose\fR]
\fIfile\fR...
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
-The \fIbuilt\-by.sh\fR script reports the name and version of the tool
+The \fIbuilt-by\fR script reports the name and version of the tool
used to build the specified file(s). This script also demonstrates
how information can be extracted from other other locations in the
file, not just the binary annotation notes.
.\" ========================================================================
.\"
.IX Title "CHECK-ABI 1"
-.TH CHECK-ABI 1 "2018-04-20" "annobin-1" "RPM Development Tools"
+.TH CHECK-ABI 1 "2018-05-31" "annobin-1" "RPM Development Tools"
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
check\-abi \- ABI Checking
.SH "SYNOPSIS"
.IX Header "SYNOPSIS"
-check\-abi.sh
+check-abi
[\fB\-\-help\fR]
[\fB\-\-version\fR]
[\fB\-\-verbose\fR]
\fIfile\fR...
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
-The \fIcheck\-abi.sh\fR script reports any potential \s-1ABI\s0 conflicts in
+The \fIcheck-abi\fR script reports any potential \s-1ABI\s0 conflicts in
the files specified. This includes the use of the
\&\fB\-fshort\-enums\fR option, the \fB\-fstack\-protector\fR option
and the \fB\-D_FORTIFY_SOURCE\fR option. All of these can affect
.\" ========================================================================
.\"
.IX Title "HARDENED 1"
-.TH HARDENED 1 "2018-05-30" "annobin-1" "RPM Development Tools"
+.TH HARDENED 1 "2018-05-31" "annobin-1" "RPM Development Tools"
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
hardened \- Hardening Checks
.SH "SYNOPSIS"
.IX Header "SYNOPSIS"
-hardened.sh
+hardened
[\fB\-\-help\fR]
[\fB\-\-version\fR]
[\fB\-\-verbose\fR]
\fIfile\fR...
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
-The \fIhardened.sh\fR script reports on the hardening status of the
+The \fIhardened\fR script reports on the hardening status of the
specified file(s). In particular it checks that the whole file was
compiled with \fB\-O2\fR or higher and the
\&\fB\-fstack\-protector\-strong\fR, \fB\-D_FORTIFY_SOURCE=2\fR,
.\" ========================================================================
.\"
.IX Title "RUN-ON-BINARIES 1"
-.TH RUN-ON-BINARIES 1 "2018-04-20" "annobin-1" "RPM Development Tools"
+.TH RUN-ON-BINARIES 1 "2018-05-31" "annobin-1" "RPM Development Tools"
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
annobin \- Annobin
.SH "SYNOPSIS"
.IX Header "SYNOPSIS"
-run\-on\-binaries\-in.sh
+run-on-binaries-in
[\fB\-\-help\fR]
[\fB\-\-version\fR]
[\fB\-\-verbose\fR]
\fIfile\fR...
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
-The \fIrun\-on\-binaries\-in.sh\fR script allows other scripts, or
+The \fIrun-on-binaries-in\fR script allows other scripts, or
programs, to be run on the executable files contained inside archives.
This includes \fBrpm\fR files, \fBtar\fR and \fBar\fR files and
compressed files.
by the \f(CW\*(C`find\*(C'\fR command, like this:
.PP
.Vb 1
-\& find . \-type f \-exec run\-on\-binaries\-in.sh <script\-to\-run> {} \e;
+\& find . \-type f \-exec run\-on\-binaries\-in <script\-to\-run> {} \e;
.Ve
.PP
The script accepts the following command line options:
## Process this file with automake to produce Makefile.in.
-dist_bin_SCRIPTS = built-by.sh check-abi.sh hardened.sh run-on-binaries-in.sh
+dist_bin_SCRIPTS = built-by check-abi hardened run-on-binaries-in
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
-dist_bin_SCRIPTS = built-by.sh check-abi.sh hardened.sh run-on-binaries-in.sh
+dist_bin_SCRIPTS = built-by check-abi hardened run-on-binaries-in
all: all-am
.SUFFIXES:
# It is intended that if recursion is needed then it will be
# invoked from find, like this:
#
-# find . -type f -exec built-by.sh {} \;
+# find . -type f -exec built-by {} \;
version=3.1
# GNU General Public License for more details.
#
# Usage:
-# check-abi.sh [switches] file(s)
+# check-abi [switches] file(s)
#
# This script does not handle directories. This is deliberate.
# It is intended that if recursion is needed then it will be
# invoked from find, like this:
#
-# find . -type f -exec check-abi.sh {} \;
+# find . -type f -exec check-abi {} \;
version=3.2
# Usage:
-# hardened.sh [switches] file(s)
+# hardened [switches] file(s)
#
# This script does not handle directories. This is deliberate.
# It is intended that if recursion is needed then it will be
# invoked from find, like this:
#
-# find . -type f -exec hardened.sh {} \;
+# find . -type f -exec hardened {} \;
# To Do:
# * Allow arguments to command line options to be separated from the
# It is intended that if recursion is needed then it will be
# invoked from find, like this:
#
-# find . -name "*.rpm" -exec run-on-binaries-in.sh <script-to-run> {} \;
+# find . -name "*.rpm" -exec run-on-binaries-in <script-to-run> {} \;
version=1.0
Examples:
- $prog hardened.sh foo.rpm
- Runs the hardened.sh script on the executable
+ $prog hardened foo.rpm
+ Runs the hardened script on the executable
files inside foo.rpm.
- $prog check-abi.sh -v fred.tar.xz
- Runs the check-abi.sh script on the decompressed
+ $prog check-abi -v fred.tar.xz
+ Runs the check-abi script on the decompressed
contents of the fred.tar.xz archive, passing the
- -v option to check-abi.sh as it does so.
+ -v option to check-abi as it does so.
$prog -V -f=list.txt readelf -a
Runs the readelf program, with the -a option on
# annobin notes, but crti.o dies not. Thus *any* program built with normal
# startup code will contain a gap.
# FIXME: Remove once we have the assembler generating notes.
-$srcdir/../scripts/check-abi.sh --readelf=$READELF --inconsistencies \
+$srcdir/../scripts/check-abi --readelf=$READELF --inconsistencies \
--ignore-FORTIFY --ignore-stack-prot \
--ignore-gaps --ignore-ABI \
abi-test.exe
# $OBJCOPY --merge-notes hardening-fail-test.exe hardening-fail-test-merged.exe
-$srcdir/../scripts/hardened.sh --readelf=$READELF --all hardening-fail-test.exe
+$srcdir/../scripts/hardened --readelf=$READELF --all hardening-fail-test.exe
# 2.30 (or later) readelf, and which were generated by a plugin attached to
# a version 8 (or later) gcc. Since neither of these versions of the tools
# are in common use (yet) the checks are disabled.
-# The other hardening properties can be deduced by the hardened.sh script
+# The other hardening properties can be deduced by the hardened script
# without needing the notes produced by annobin, so that is why the test is
# allowed to proceed.
# FIXME: Remove the --skip= options once readelf and gcc have been updated.
# is built with -fPIC and -fno-stack-protection. /usr/lib64/Scrti.o is built
# with -fpie which makes the pic test impossible.
-$srcdir/../scripts/hardened.sh --readelf=$READELF \
+$srcdir/../scripts/hardened --readelf=$READELF \
--skip=fort -k=operator --skip=clash --skip=cf -k=cet \
--skip=pic --skip=stack --skip=realign \
hardening-test.exe
git://sourceware.org / annobin.git / commitdiff