What is the difference between "LSB executable" (ET_EXEC) and "LSB shared object" (ET_DYN)?

Question

With two files, one compiled and linked with gcc and the other manually with nasm and ld I get

• ELF 32-bit LSB shared object ...
• ELF 32-bit LSB executable ...

What's the difference between these two things? I can see with readelf -h that one is

• Type: DYN (Shared object file)
• Type: EXEC (Executable file)

I can see these documented on Wikipedia as ET_DYN and ET_EXEC. What are the practical differences between these two?

Answer 1

It seems this has something to do with Position Independent Executable (PIE). When GCC compiles executable by defaults it makes them PIE which changes the output flag on the ELF Header to ET_DYN.

You can disable the generation of PIE executables with

• gcc -no-pie

If you're seeing this check the default options gcc is configured with gcc -v, you should see something like --enable-default-pie.

Answer inspired by this submission on StackOverflow. I intend to play more with it and explain more here.

Answer 2

It appears that the main effect of ET_EXEC vs ET_DYN in the Linux kernel / dynamic loader is to inform if the executable can be placed in random memory locations or not with ASLR.

As you concluded then, PIE executables are DYN, as they can be randomized, exactly like shared libraries.

I have explored this is more detail and:

• pointed to the relevant Linux kernel 5.0 code at: How to test whether a Linux binary was compiled as position independent code?
• shown how to observe PIE ASLR yourself at: https://stackoverflow.com/questions/2463150/what-is-the-fpie-option-for-position-independent-executables-in-gcc-and-ld/51308031#51308031