What is the difference between "LSB executable" (ET_EXEC) and "LSB shared object" (ET_DYN)?

It seems this has something to do with Position Independent Executable (PIE). When GCC compiles executable by defaults it makes them PIE which changes the output flag on the ELF Header to ET_DYN.

You can disable the generation of PIE executables with

• gcc -no-pie

If you're seeing this check the default options gcc is configured with gcc -v, you should see something like --enable-default-pie.

Answer inspired by this submission on StackOverflow. I intend to play more with it and explain more here.

It appears that the main effect of ET_EXEC vs ET_DYN in the Linux kernel / dynamic loader is to inform if the executable can be placed in random memory locations or not with ASLR.

As you concluded then, PIE executables are DYN, as they can be randomized, exactly like shared libraries.

I have explored this is more detail and:

• pointed to the relevant Linux kernel 5.0 code at: How to test whether a Linux binary was compiled as position independent code?
• shown how to observe PIE ASLR yourself at: https://stackoverflow.com/questions/2463150/what-is-the-fpie-option-for-position-independent-executables-in-gcc-and-ld/51308031#51308031