binary-hardening

# Binary hardening ## Contract | Field | Bound contract | |---|---| | Trigger | Hardening an ELF binary or its build: checksec analysis, RELRO, PIE, stack canaries, FORTIFY_SOURCE, CET and shadow stack, Clang CFI, AArch64 BTI and PAC, MTE, or seccomp syscall filtering. | | Authority | Read-only. The skill emits flags, commands, and analysis; it writes no files. Nothing to roll back. No remote mutation. | | Side effect | Hardening flag sets, verification commands, and a protection report per binary. | | Done | The binary's current mitigations are measured, the missing ones have concrete flags, and each flag is confirmed supported by the project's compiler and libc. | ## Inputs 1. Binary or build (required): the ELF to check, or the build to harden. 2. Toolchain (required): `gcc --version` or `clang --version`, `ld --version`, and `ldd --version` for the libc. Grounded channels: GCC 16.x, Clang 23.1.0, binutils 2.47, glibc 2.44. 3. Target platforms (optional): x86-64, AArch64, or both. 4. Threat scope (optional): which mitigations the deployment actually needs. ## Procedure 1. Measure the binary first: ```bash checksec --file=./mybinary checksec --dir=/usr/bin ``` | Protection | Good | Concern | |---|---|---| | RELRO | Full RELRO | Partial or none | | Stack canary | Canary found | None | | NX | NX enabled | Disabled | | PIE | PIE enabled | None | | FORTIFY | Yes | No | Done when: every row has a measured value for the binary. 2. Apply the hardening flag set that the to...