title: How is the address of the text section of a PIE executable determined in Linux?
body: <p>First I tried to reverse engineer it a bit:</p>
  
  <pre><code>printf '
  #include &lt;stdio.h&gt;
  int main() {
      puts("hello world");
  }
  ' &gt; main.c
  gcc -std=c99 -pie -fpie -ggdb3 -o pie main.c
  echo 2 | sudo tee /proc/sys/kernel/randomize_va_space
  readelf -s ./pie | grep -E 'main$'
  gdb -batch -nh \
    -ex 'set disable-randomization off' \
    -ex 'start' -ex 'info line' \
    -ex 'start' -ex 'info line' \
    -ex 'set disable-randomization on' \
    -ex 'start' -ex 'info line' \
    -ex 'start' -ex 'info line' \
    ./pie \
  ;
  </code></pre>
  
  <p>Output:</p>
  
  <pre><code>64: 000000000000063a    23 FUNC    GLOBAL DEFAULT   14 main
  Temporary breakpoint 1, main () at main.c:4
  4           puts("hello world");
  Line 4 of "main.c" starts at address 0x5575f5fd263e &lt;main+4&gt; and ends at 0x5575f5fd264f &lt;main+21&gt;.
  Temporary breakpoint 2 at 0x5575f5fd263e: file main.c, line 4.
  
  Temporary breakpoint 2, main () at main.c:4
  4           puts("hello world");
  Line 4 of "main.c" starts at address 0x55e3fbc9363e &lt;main+4&gt; and ends at 0x55e3fbc9364f &lt;main+21&gt;.
  Temporary breakpoint 3 at 0x55e3fbc9363e: file main.c, line 4.
  
  Temporary breakpoint 3, main () at main.c:4
  4           puts("hello world");
  Line 4 of "main.c" starts at address 0x55555555463e &lt;main+4&gt; and ends at 0x55555555464f &lt;main+21&gt;.
  Temporary breakpoint 4 at 0x55555555463e: file main.c, line 4.
  
  Temporary breakpoint 4, main () at main.c:4
  4           puts("hello world");
  Line 4 of "main.c" starts at address 0x55555555463e &lt;main+4&gt; and ends at 0x55555555464f &lt;main+21&gt;.
  </code></pre>
  
  <p>which indicates that it is <code>0x555555554000</code> + random offset + <code>63e</code>.</p>
  
  <p>But then I tried to grep the Linux kernel and glibc source code for <code>555555554</code> and there were no hits.</p>
  
  <p>Which part of which code calculates that address?</p>
  
  <p>I came across this while answering: <a href="https://stackoverflow.com/questions/2463150/what-is-the-fpie-option-for-position-independent-executables-in-gcc-and-ld/51308031#51308031">What is the -fPIE option for position-independent executables in gcc and ld?</a></p>