RELRO, short for Relocation Read-Only, is an ELF hardening feature that protects relocation-related data after program startup. During loading, the dynamic linker resolves addresses for symbols and then can mark critical relocation tables read-only, making them harder to overwrite. In practice, this limits attacks that try to redirect execution by tampering with the Global Offset Table (GOT) or other linker-managed structures.
For defenders, RELRO is a useful build-time signal: full RELRO is stronger because it protects more of the binary’s relocation data, while partial RELRO leaves some writable targets available longer. In malware analysis, seeing partial RELRO does not prove sophistication; it simply shows the sample was compiled with common Linux mitigations. Attackers still prefer binaries without these protections because they are easier to hook, patch, or redirect during exploitation. RELRO is one layer of defense, not a complete barrier.