Consider Annobin `-grecord-gcc-switches` for C and C++ Compiler Hardening Guide

[thomasnyman]

Annobin is a binary annotation plugin for GCC that, among other things, allows the recording of the used compiler options flags used to produced a binary. This allows to determine if an object was compiled according to applicable security hardening polices.

Annobin is primarily used in Fedora currently, but could also be used in other context where it may be desirable to be able to precisely determine which compiler options have been used to produce a binary.

Resources:

• https://sourceware.org/annobin/
• https://fedoraproject.org/wiki/Toolchain/Watermark