linux on Kshitij Patilhttps://ksh.fyi/tags/linux/Recent content in linux on Kshitij PatilHugoen-usSat, 03 Oct 2026 20:00:00 +0530Where things live in a C program: .text, .rodata, .data, .bss, stackhttps://ksh.fyi/notes/c-memory-sections/Sat, 03 Oct 2026 20:00:00 +0530https://ksh.fyi/notes/c-memory-sections/<p>A compiled C program is an ELF file split into <strong>sections</strong>. The loader maps them into memory with different permissions, and those permissions are what the CPU enforces at runtime.</p> <table> <thead> <tr> <th>Section</th> <th>Holds</th> <th>Permissions</th> <th>Example</th> </tr> </thead> <tbody> <tr> <td><code>.text</code></td> <td>machine code</td> <td>read + execute</td> <td><code>main</code></td> </tr> <tr> <td><code>.rodata</code></td> <td>read-only data</td> <td>read (no write)</td> <td>string literals, <code>static const</code> tables</td> </tr> <tr> <td><code>.data</code></td> <td>initialized globals / statics</td> <td>read + write</td> <td><code>static char buf[] = &quot;hi&quot;;</code></td> </tr> <tr> <td><code>.bss</code></td> <td>zero-initialized globals / statics</td> <td>read + write</td> <td><code>static int counter;</code></td> </tr> <tr> <td>stack</td> <td>locals, return addresses</td> <td>read + write</td> <td><code>char buf[8];</code> inside a function</td> </tr> </tbody> </table> <ul> <li><code>.data</code> and <code>.rodata</code> are both <strong>in the binary</strong>; &ldquo;in the binary&rdquo; doesn&rsquo;t mean read-only. The section decides that.</li> <li><code>.bss</code> takes no space in the file (type <code>NOBITS</code>): the loader just hands out zeroed memory.</li> <li>Writing to <code>.rodata</code> (e.g. through a pointer to a string literal) → the page isn&rsquo;t writable → <code>SIGSEGV</code>.</li> </ul> <h2 id="see-it-yourself">See it yourself</h2> <p>Sections and their flags (<code>A</code> = alloc, <code>W</code> = write, <code>X</code> = exec):</p>A compiled C program is an ELF file split into sections. The loader maps them into memory with different permissions, and those permissions are what the CPU enforces at runtime.

Section Holds Permissions Example
.text machine code read + execute main
.rodata read-only data read (no write) string literals, static const tables
.data initialized globals / statics read + write static char buf[] = "hi";
.bss zero-initialized globals / statics read + write static int counter;
stack locals, return addresses read + write char buf[8]; inside a function
  • .data and .rodata are both in the binary; “in the binary” doesn’t mean read-only. The section decides that.
  • .bss takes no space in the file (type NOBITS): the loader just hands out zeroed memory.
  • Writing to .rodata (e.g. through a pointer to a string literal) → the page isn’t writable → SIGSEGV.

See it yourself

Sections and their flags (A = alloc, W = write, X = exec):

readelf -SW ./prog | grep -E '\.text|\.rodata|\.data |\.bss'

  [12] .text    PROGBITS ... AX
  [14] .rodata  PROGBITS ... A
  [22] .data    PROGBITS ... WA
  [23] .bss     NOBITS   ... WA

Sections are grouped into segments (readelf -lW ./prog, the LOAD lines), and segments are what actually get mapped. At runtime, compare addresses (printf("%p", (void *)ptr)) against /proc/self/maps:

aaaabfd80000-aaaabfd81000 r-xp ... /path/to/prog   <- .text + .rodata (literal was here)
aaaabfd9f000-aaaabfda0000 r--p ... /path/to/prog   <- RELRO (.got etc., made read-only after startup)
aaaabfda0000-aaaabfda1000 rw-p ... /path/to/prog   <- .data / .bss (static array was here)
ffffe15ba000-ffffe15db000 rw-p ...  [stack]         <- local array was here

Note: on this arm64 build .rodata shares the r-xp segment with .text. Other toolchains (e.g. x86-64 with -z separate-code) give it its own r--p mapping. Either way: not writable.

References: man 5 elf, man 1 readelf, man 5 proc (/proc/pid/maps).

]]>