I pretty much understand how the system call works and the need of system calls in general. However, I don't understand why do some system calls like create() file, read() file and close() should be executed only in kernel mode.

For example in create () and read() file, why can't it happen in userspace or usermode ? How could user possibly damage the system by creating and reading a file ? I have the same doubt in case of close() system call too.

  • 3
    The kernel keeps a table of file descriptors assigned to some process. How do you want to update information in this table, if you don't switch to kernel space? (And BTW, "system call" is pretty eqivalent to "switch to kernel space". There are library function calls that are implemented in user space, without system calls).
    – dirkt
    Commented Nov 23, 2017 at 8:01
  • @dirkt I want to know why is there a need to switch to kernel space for the above system calls(read,close,create)? Why can't it be implemented in user space?
    – Zephyr
    Commented Nov 23, 2017 at 8:07
  • 3
    Which part of "the table is in kernel space, user space can't access kernel space, file operations must update the table" is not acceptable as a reason? Moreoever, "read must access the disk etc., this is done by drivers, drivers are in kernel space".
    – dirkt
    Commented Nov 23, 2017 at 8:33
  • 2
    There’s also the small issue of access control (who do you trust to manage that?). But see micro-kernels for a slightly different take on all this... Commented Nov 23, 2017 at 8:48

2 Answers 2


I don't understand why do some system calls like create() file, read() file and close() should be executed only in kernel mode.

Well, system calls by definition are executed in kernel mode. In user space, these are usually available via library wrapper functions which have the same name. From man 2 intro:

A system call is an entry point into the Linux kernel. Usually, system calls are not invoked directly: instead, most system calls have corresponding C library wrapper functions which perform the steps required (e.g., trapping to kernel mode) in order to invoke the system call. Thus, making a system call looks the same as invoking a normal library function.

(see also man 2 syscall)

As said by @dirkt and @StephenKitt in the comments, the system calls you mentioned need to run in kernel space because they have to write on the file descriptor table, access the drivers for file I/O, verify access rights etc.


For example in create() and read() file, why can't it happen in userspace?

On some platforms (including Linux-based ones) it is quite possible to run filesystem IO from user-space. It's known as FUSE and you can read Filesystem in Userspace for one introduction to the topic.

There are many FUSE-based filesystems available, including SSHFS (filesystem over ssh) and S3QL (filesystem on cloud storage).

The kernel mediates the layer between the user-space client (an application program) and the FUSE implementation so that the filesystem semantics are validated and consistent, but the actual IO code for creat(), open(), read(), write(), fcntl(), close(), etc. is all run from a user-space service.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .