I don\'t quite understand how variables can be stored in the text section and how they can be manipulated. Shouldn\'t all variables be in the .data section and aren\'t all p
Well, the data & code are just bytes. Only how you interpret them makes them what they are. Code can be interpreted as data and vice versa. In most case it will produce the something that's invalid but anyway it's possible.
Attributes of the section are dependant on the linker and most of them by default make the .text section RO, but it doesn't mean it can't be changed.
The whole example is a clever way to obtain the address of /bin/sh just by using the call. Basically the call places on the stack the address of the next instruction (next bytes) and in this case it will be the address of this string so pop esi will get that address from the stack and use it.