There are notions about privilege that occur at the processor level and the operating system. With processors, there are instructions that can't be executed except in supervisor mode. Similarly, in the operating system, there are operations that cannot be performed without going through the kernel (syscalls).

Question: How do these two concepts map to each other? Can we rewrite a system call entirely in user space? If not, is it because a system call hides the aforementioned privileged instructions?

  • 1
    see github.com/wolfcw/libfaketime – Rui F Ribeiro Jul 26 '17 at 18:32
  • 1
    Another good example is github.com/stewartsmith/libeatmydata, which turns sync(), fsync(), and fdatasync() calls into no-ops. – Austin Hemmelgarn Jul 26 '17 at 19:06
  • So if the answer is yes, we can rewrite the provided syscalls in user-space is the concept of the syscall more about providing functionality rather than about privilege? And then why do we need to flip the mode bit with a syscall? Merely to access protected memory? – limik Jul 26 '17 at 20:15

Simply put, the privileged instructions are usually those related to I/O with hardware devices, or memory protection. Access to those from arbitrary processes without going through some central logic would make it possible for processes to trash the memory of other processes, mess up the file system etc. Either by accident or on purpose.

If we consider some common system calls, there's e.g. open(), read(), write() and others that access files and in the end result in I/O to the disk or some other device. Or fork() and mmap() that affect the memory of a process or other processes.

Of course something like making a process not call a system call doesn't require privilege, and can be done with a library. Same for faking the results of a system call. Though of course something like changing all time stamps two weeks backwards (like the libfaketime example) requires finding out the correct time first, and that has to happen through a system call. In addition to libfaketime and libeatmydata, there's e.g. fakeroot that pretends that a process is running under UID 0.

  • but is the correlation one to one -- i.e. all syscalls rely on privileged instructions? see my comment above. – limik Jul 27 '17 at 15:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.