1

I'm trying to pull out SysCalls from source code but I'm a little confused. I've found source like https://chromium.googlesource.com/chromiumos/docs/+/master/constants/syscalls.md and https://filippo.io/linux-syscall-table/ are syscalls the same as the functions being called in C? or is a syscall something like syscall(SYS_gettid) where the syscall function calls and actual syscall?

I'm trying to extract syscalls that an application uses.

Improve this question

2 Answers 2

Reset to default
2

Most of the time, you won’t find explicit syscalls in a program’s source code: applications are written with calls into the corresponding language’s runtime library, and it’s that library which takes care of calling the kernel. Many language runtime libraries delegate that responsibility in turn, relying on the C library.

There isn’t even a one-to-one correspondence between C library functions and syscalls. Some C library functions don’t use any syscalls at all; others use several. The mapping even changes from one architecture to another — Linux has a number of architecture-specific syscalls — and the syscalls which are actually used can very depending on the running kernel and C library, e.g. as the kernel adds new syscalls and support for them is added to the C library.

Improve this answer
2
  • Thanks for the answer. Learned a lot on that one. Would strace be one practical way to get a list of syscalls in an application?
    – Jason
    Mar 2, 2021 at 17:26
  • 2
    strace will give you a list of the syscalls made by a program invocation; it won’t give you an exhaustive list of the syscalls in an application.
    – Stephen Kitt
    Mar 2, 2021 at 17:28
1

Download the source of installwatch, part of the checkinstall package, and modify installwatch.

installwatch uses an LD_PRELOAD trick to intercept ALL system calls. Read man ld.so.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .