{ "content": [ { "type": "text", "text": "# hardening-check (man)\n\n## NAME\n\nhardening-check - check binaries for security hardening features\n\n## SYNOPSIS\n\nhardening-check [options] [ELF ...]\nExamine a given set of ELF binaries and check for several security hardening features,\nfailing if they are not all found.\n\n## DESCRIPTION\n\nThis utility checks a given list of ELF binaries for several security hardening features that\ncan be compiled into an executable. These features are:\n\n## Sections\n\n- **NAME**\n- **SYNOPSIS**\n- **DESCRIPTION** (5 subsections)\n- **OPTIONS**\n- **RETURN VALUE**\n- **AUTHOR**\n- **COPYRIGHT AND LICENSE**\n- **SEE ALSO**\n\nUse structuredContent.sections for detailed options, examples, and full documentation.\n" } ], "structuredContent": { "command": "hardening-check", "section": "", "mode": "man", "summary": "hardening-check - check binaries for security hardening features", "synopsis": "hardening-check [options] [ELF ...]\nExamine a given set of ELF binaries and check for several security hardening features,\nfailing if they are not all found.", "tldr_summary": null, "tldr_examples": [], "tldr_source": null, "flags": [], "examples": [], "see_also": [ { "name": "gcc", "section": "1", "url": "https://www.chedong.com/phpMan.php/man/gcc/1/json" }, { "name": "hardening-wrapper", "section": "1", "url": "https://www.chedong.com/phpMan.php/man/hardening-wrapper/1/json" }, { "name": "HARDENING-CHECK", "section": "1", "url": "https://www.chedong.com/phpMan.php/man/HARDENING-CHECK/1/json" } ], "section_outline": [ { "name": "NAME", "lines": 2, "subsections": [] }, { "name": "SYNOPSIS", "lines": 5, "subsections": [] }, { "name": "DESCRIPTION", "lines": 3, "subsections": [ { "name": "Position Independent Executable", "lines": 5 }, { "name": "Stack Protected", "lines": 8 }, { "name": "Fortify Source functions", "lines": 12 }, { "name": "Read-only relocations", "lines": 6 }, { "name": "Immediate binding", "lines": 5 } ] }, { "name": "OPTIONS", "lines": 45, "subsections": [] }, { "name": "RETURN VALUE", "lines": 4, "subsections": [] }, { "name": "AUTHOR", "lines": 2, "subsections": [] }, { "name": "COPYRIGHT AND LICENSE", "lines": 6, "subsections": [] }, { "name": "SEE ALSO", "lines": 5, "subsections": [] } ], "sections": { "NAME": { "content": "hardening-check - check binaries for security hardening features\n", "subsections": [] }, "SYNOPSIS": { "content": "hardening-check [options] [ELF ...]\n\nExamine a given set of ELF binaries and check for several security hardening features,\nfailing if they are not all found.\n", "subsections": [] }, "DESCRIPTION": { "content": "This utility checks a given list of ELF binaries for several security hardening features that\ncan be compiled into an executable. These features are:\n", "subsections": [ { "name": "Position Independent Executable", "content": "This indicates that the executable was built in such a way (PIE) that the \"text\"\nsection of the program can be relocated in memory. To take full advantage of this\nfeature, the executing kernel must support text Address Space Layout Randomization\n(ASLR).\n" }, { "name": "Stack Protected", "content": "This indicates that there is evidence that the ELF was compiled with the gcc(1)\noption -fstack-protector (e.g. uses stackchkfail). The program will be resistant\nto having its stack overflowed.\n\nWhen an executable was built without any character arrays being allocated on the\nstack, this check will lead to false alarms (since there is no use of\nstackchkfail), even though it was compiled with the correct options.\n" }, { "name": "Fortify Source functions", "content": "This indicates that the executable was compiled with -DFORTIFYSOURCE=2 and -O1 or\nhigher. This causes certain unsafe glibc functions with their safer counterparts\n(e.g. strncpy instead of strcpy), or replaces calls that are verifiable at runtime\nwith the runtime-check version (e.g. memcpychk insteade of memcpy).\n\nWhen an executable was built such that the fortified versions of the glibc functions\nare not useful (e.g. use is verified as safe at compile time, or use cannot be\nverified at runtime), this check will lead to false alarms. In an effort to mitigate\nthis, the check will pass if any fortified function is found, and will fail if only\nunfortified functions are found. Uncheckable conditions also pass (e.g. no functions\nthat could be fortified are found, or not linked against glibc).\n" }, { "name": "Read-only relocations", "content": "This indicates that the executable was build with -Wl,-z,relro to have ELF markings\n(RELRO) that ask the runtime linker to mark any regions of the relocation table as\n\"read-only\" if they were resolved before execution begins. This reduces the possible\nareas of memory in a program that can be used by an attacker that performs a\nsuccessful memory corruption exploit.\n" }, { "name": "Immediate binding", "content": "This indicates that the executable was built with -Wl,-z,now to have ELF markings\n(BINDNOW) that ask the runtime linker to resolve all relocations before starting\nprogram execution. When combined with RELRO above, this further reduces the regions\nof memory available to memory corruption attacks.\n" } ] }, "OPTIONS": { "content": "--nopie, -p\nDo not require that the checked binaries be built as PIE.\n\n--nostackprotector, -s\nDo not require that the checked binaries be built with the stack protector.\n\n--nofortify, -f\nDo not require that the checked binaries be built with Fortify Source.\n\n--norelro, -r\nDo not require that the checked binaries be built with RELRO.\n\n--nobindnow, -b\nDo not require that the checked binaries be built with BINDNOW.\n\n--nocfprotection, -b\nDo not require that the checked binaries be built with control flow protection.\n\n--quiet, -q\nOnly report failures.\n\n--verbose, -v\nReport verbosely on failures.\n\n--report-functions, -R\nAfter the report, display all external functions needed by the ELF.\n\n--find-libc-functions, -F\nInstead of the regular report, locate the libc for the first ELF on the command line\nand report all the known \"fortified\" functions exported by libc.\n\n--color, -c\nEnable colorized status output.\n\n--lintian, -l\nSwitch reporting to lintian-check-parsable output.\n\n--debug Report some debugging during processing.\n\n--help, -h, -?\nPrint a brief help message and exit.\n\n--man, -H\nPrint the manual page and exit.\n", "subsections": [] }, "RETURN VALUE": { "content": "When all checked binaries have all checkable hardening features detected, this program will\nfinish with an exit code of 0. If any check fails, the exit code with be 1. Individual checks\ncan be disabled via command line options.\n", "subsections": [] }, "AUTHOR": { "content": "Kees Cook \n", "subsections": [] }, "COPYRIGHT AND LICENSE": { "content": "Copyright 2009-2013 Kees Cook .\n\nThis program is free software; you can redistribute it and/or modify it under the terms of\nthe GNU General Public License as published by the Free Software Foundation; version 2 or\nlater.\n", "subsections": [] }, "SEE ALSO": { "content": "gcc(1), hardening-wrapper(1)\n\n\n\nDebian Utilities 2026-03-04 HARDENING-CHECK(1)", "subsections": [] } } } }