why code at .rodata executes [closed]

Question

How come the following code executes if buf* is @ rodata segment ?

#include <stdio.h>

char *buf[] = {
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\
\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\
\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\
\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\
\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\
\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\
\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\
\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\
\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\
\xc3 IS THIS DATA?"
};
char arr_chr[500] = "I AM READ_WRITE";

int main(){
    ((void (*)()) buf[0])();

    printf("%s\n", buf[0]);
    printf("%s\n", arr_chr);
}

compiled with gcc version 7.3.0 without flags @ x86_64-linux-gnu

file's output:

check: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, not stripped

Answer 1

I think you mixed up segments and sections on ELF. Unlike PE where sections define how the application is mapped and page permissions, ELF loaders only use segments PT_LOAD to do that. Segments don't have name, so there's nothing like .rodata segment, only .rodata section. You can verify that be setting 0x0 to the field ElfN_Ehdr::e_shoff, it'll still work.

Now regarding the initial question, it seems ELF executable used to have only two PT_LOAD segments, one is R-X and RW-. If a data is const, it'll be stored inside the first segment which is also executable. It's not true anymore on my archlinux.