ELF files on Linux

Post by yjftsjthsd-h » Thu, May 16, 2019, 10:28 PM UTC

AceJohnny2 wrote: post #17

haberman wrote: post #16

Earlier quoted context omitted.

That is a deep and interesting question. I'm not sure I can give a great answer, but here are a few thoughts. If we look at the file format itself (separate from the features/semantics of the linker and loader), I think ELF is simpler and more orthogonal. You can iterate over the section/segment tables of an ELF file without knowing anything about what each section/segment means. ELF nicely decouples the high-level "…

Thanks! Regarding multi-arch support, Ryan C. Gordon (Linux game porter extraordinaire, icculus.org) had proposed FatELF [1] back in 2009 (LWN coverage [2]). It seemed simple enough to implement, but never really picked up steam (IMHO for reasons that speak of the culture of the Linux ecosystem). [1] http://icculus.org/fatelf/ [2] https://lwn.net/Articles/359070/

Post by AceJohnny2 » Thu, May 16, 2019, 11:14 PM UTC

yjftsjthsd-h wrote: post #21

AceJohnny2 wrote: post #17

Earlier quoted context omitted.

Thanks! Regarding multi-arch support, Ryan C. Gordon (Linux game porter extraordinaire, icculus.org) had proposed FatELF [1] back in 2009 (LWN coverage [2]). It seemed simple enough to implement, but never really picked up steam (IMHO for reasons that speak of the culture of the Linux ecosystem). [1] http://icculus.org/fatelf/ [2] https://lwn.net/Articles/359070/

> reasons that speak of the culture of the Linux ecosystem "Everyone ships source; just recompile"? It would be convenient, but with source and a compiler you can hit everything anyways.

Post by usr1106 » Thu, May 16, 2019, 11:22 PM UTC

jzwinck wrote: post #22

kccqzy wrote: post #18

One thing that's on my mind but haven't been able to spend time investigating is the fact that on my machine (Ubuntu 19.04), almost all distribution-installed executables are not ELF executables per se, but ELF shared objects. Running `file /bin/ls` shows that it's an ELF 64-bit LSB shared object. Running `readelf -h /bin/ls` also says that the type is DYN. Is the executable type basically deprecated now?

Position Independant Executable (PIE) files are detected as shared libraries because they use the same old identifier as position independent shared libraries. The ELF folks could have added a new type but did not, leading to some confusion like this: https://bugs.launchpad.net/ubuntu/+source/shared-mime-info/+... PIE is a security feature, which is why it has proliferated on newer systems. See https://access.redhat.…

  $ cat show-addr.c
  #include 
  
  int main(int argc, char **argv)
  {
    printf("main() is at %p\n", main);
  }
  $ gcc -o show-addr show-addr.c
  $ file show-addr
  show-addr: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/l, for GNU/Linux 2.6.32, BuildID[sha1]=60c8b61a7040adccc90934bc79e24342eecae15a, not stripped
  $ ./show-addr
  main() is at 0x400526
  $ ./show-addr
  main() is at 0x400526
  $ gcc -pie -fPIC -o show-addr.pie show-addr.c
  $ file show-addr.pie 
  show-addr.pie: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/l, for GNU/Linux 2.6.32, BuildID[sha1]=73ae8065a65aad4b829567b7ce3464fb5d1e3fc3, not stripped
  $ ./show-addr.pie 
  main() is at 0x55c722ae1750
  $ ./show-addr.pie 
  main() is at 0x5649bf97b750
  $

Post by saagarjha » Thu, May 16, 2019, 11:51 PM UTC