Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [syscalls]

The tag has no usage guidance.

0
votes
2answers
42 views

Can one processes have a descriptor that is non-blocking while another process have a descriptor referencing the same file/socket that is blocking?

I am more interested in sockets than regular files, but basically I want to know whether one process can "see" a socket as blocking where another process can see it as non-blocking. I am guessing yes,...
1
vote
1answer
18 views

How do I run multiple processes with the same process group id?

I am learning how to use the killpg syscall. So for an experiment, I want to start two new processes with the same pgid and then attempt to kill them using killpg. I read about setsid so I tried ...
0
votes
1answer
51 views

Read arbitrary amount of memory with process_vm_readv

For process_vm_readv the linux man page states: [...] (Avoid) spanning memory pages (typically 4KiB) in a single remote iovec element. (Instead, split the remote read into two remote_iov elements ...
1
vote
1answer
84 views

How should I pass 32-bit arguments to Linux syscalls on x86_64?

If a syscall needs some 32-bit arguments like uid_t or int (for file descriptors) or unsigned int or even some 16-bit type, how can I pass them using 64-bit registers? Do I need to zero-extend or ...
1
vote
2answers
66 views

How does mmap work with x32 ABI?

I'm looking at Linux 5.0-rc5 source code in arch/x86/entry/syscalls/syscall_64.tbl, find that there's no separate syscall number for x32 mmap. So how does the kernel know we're using the x32 ABI in ...
0
votes
0answers
117 views

Chrooted upload-only SFTP account - what requests to blacklist/whitelist?

I'm trying to make a chrooted SFTP account which could allow only upload of files into an unique directory - ie. /upload/$timestamp. Let's imagine that it is a shared upload account where one can ...
0
votes
0answers
42 views

Communicating between userland and kernel space (KEXT) on MacOS

In order to make it easier to develop a kernel module, I am considering Loadable kernel modules (LKMs) on MacOS. This way you have a base kernel module and your main kernel module which is an LKM ...
5
votes
0answers
68 views

How to compare string values with seccomp?

Some Linux system calls (such as execve, openat) have string type arguments. But the comparison function SCMP_CMP provided by seccomp seems to be comparing two pointers. So how can I limit files that ...
1
vote
1answer
63 views

Run program and intercept and redirect syscalls

I would like to run a program, and when that program attempts to read a specific file, I would like it to read a different file of my choosing instead. Specifically, the program attempts to read a ...
1
vote
1answer
314 views

Is there a way to prevent sigkill to reach a process?

I know that a process cannot prevent SIGKILL. But is there an external way to temporarily prevent SIGKILL to reach a (specific) process? (something like dropping packets by firewalls).
1
vote
0answers
37 views

Does every syscall require at most 1 capability on Linux?

I am trying to understand the relationship between capabilities and syscalls on Linux. As far as I know, the capabilities of a process are only ever considered when that process calls a syscall. When ...
1
vote
1answer
118 views

create a vdso in linux [closed]

I'm currently trying to implement my own VDSO. I have seen this tutorial which explains how to do this. However, this tutorial is made for Linux 2.6.x and I would like to use it on Linux 4.8.x. But ...
1
vote
1answer
561 views

Why can the kernel not use SSE/AVX registers and instructions?

This post from StackOverflow has this, In some environments there there is a restriction on certain instructions or using certain registers. For example, in the Linux kernel, use of SSE/AVX or FP ...
6
votes
2answers
67 views

Is it normal that bash stat() and access() much, before commands?

Running strace on the bash shell that is instructed to run mkdir provided this output which shows lots of stats prior to execve the actual mkdir binary: BASH$> strace -f sh -c "bash -c \"mkdir /...
10
votes
3answers
1k views

What is the time unit that strace uses when displaying time spent in syscalls?

When using the command strace with the flag -T, I would like to know what is the time unit used to display time spent in syscalls? I assume it should be in seconds, but I am not quite sure and it ...
7
votes
2answers
1k views

Why is there no apparent clone or fork in simple bash command and how it's done?

Consider the following (with sh being /bin/dash): $ strace -e trace=process sh -c 'grep "^Pid:" /proc/self/status /proc/$$/status' execve("/bin/sh", ["sh", "-c", "grep \"^Pid:\" /proc/self/status /".....
0
votes
1answer
164 views

Knowing when a write() on a serial port has finished transmitting data

I need to synchronize an IO pin value with a write to a serial port from user space (because I wasn't yet able to do it from kernel space - see my other question). My code (leaving out error checking) ...
2
votes
1answer
172 views

How can I enumerate unfiltered Linux syscalls? [duplicate]

What's the best way to enumerate all available Linux syscalls? To clarify, I'm asking how to discover which syscalls are being filtered by seccomp while running in a containerized environment.
1
vote
1answer
113 views

How does Linux kernel handles multiple parallel syscall() request?

I am wondering what will happen if there is a multiple core system say 8 core for ex. and each task running on core makes syscall() request to kernel at same time. My question is how kernel handles ...
2
votes
1answer
65 views

Is there a “low level” way of determining what syscalls a process are calling?

I have a binary that is freezing, and that binary happens to be my package manager, preventing me from installing any new packages. Running under gdb, I can get a back trace when the process is ...
2
votes
3answers
740 views

Filter out failed syscalls from strace log

I can run strace on a command like sleep 1 and see what files it's accessing like this: strace -e trace=file -o strace.log sleep 1 However, on my machine, many of the calls have a return value of -1 ...
1
vote
2answers
65 views

Man pages: When to put a new system call in section 2 and when in section 3?

For an exercise at the university, we are asked to extend Minix (v2) with a system call utctime that properly calculates the leap seconds (which Minix' implementation of time does not do). We've ...
1
vote
0answers
30 views

Is there a way in which we can notify the tracer (parent process) when the tracee (child process) executes a branch instruction?

As we know, the ptrace system call is one of the most powerful system calls in unix-like systems. All debugging software use ptrace for monitoring and manipulating another process, i.e. tracee. Using ...
1
vote
0answers
85 views

Why does recvmsg not accept MSG_CTRUNC as a flag?

according to man 2 recv recvmsg may return MSG_TRUNC MSG_TRUNC indicates that the trailing portion of a datagram was dis‐ carded because the datagram was larger than the buffer ...
0
votes
0answers
199 views

Creating an exact copy of a whole process?

fork() forks a process, but it will not copy all of its threads; nor will it create a clone of all its fds: the fds are shared between parent and child. I want a way of do a complete fork. So after I ...
1
vote
1answer
333 views

Why is sys_call_table predictable?

In (or after?) 2.4 the sys_call_table symbol was no longer exported to make it harder to hook system calls. Ignoring that you can still obtain this information from the IDT or by reading /boot/System....
5
votes
4answers
7k views

Where do you find the syscall table for Linux?

I see a lot of people online referencing arch/x86/entry/syscalls/syscall_64.tbl for the syscall table, that works fine. But a lot of others reference /include/uapi/asm-generic/unistd.h which is ...
2
votes
1answer
350 views

Performance of calling POSIX-specified functions versus direct Linux kernel calls

In an answer over on Stack Overflow, I provided a code sample to perform some small task referenced in the question. The original question had to do with the fastest-performing technique (so ...
5
votes
1answer
311 views

Why do `time` and `strace -c` differ?

To my understanding, time would record the total amount of time spend in syscalls. Then I would expect the cumulative totals for sys time as reported by time and strace -fc to be the same. But they ...
1
vote
1answer
108 views

Blocking mount syscall

I would like to block the mount syscall when someone wants to remount /system in read-write mode. Which means i would like to not allow the exection of the following: mount -o remount,rw /system. ...
0
votes
1answer
184 views

High number of failed syscalls against httpd

A CentOS7 server running Apache HTTPD server (and a Wordpress site) is undergoing regular scanning with wpscan. This results in a kernel panic: Kernel panic - not syncing: audit: backlog limit ...
2
votes
1answer
757 views

What is the NR_Syscalls value?

I am trying to understand code for a C program that among other things, increments the NR_syscalls value of the Linux kernel. Does the NR_syscalls value store the number of system calls in the system ...
0
votes
1answer
2k views

Using a file descriptor in a system call [closed]

Let's suppose that I want to use a file descriptor in a system call (the fd number would be provided via a parameter). What is to be expected if a user space program uses this system call? Where would ...
15
votes
3answers
2k views

Call a Linux syscall from a scripting language

I want to call a Linux syscall (or at least the libc wrapper) directly from a scripting language. I don't care what scripting language - it's just important that it not be compiled (the reason ...
1
vote
1answer
48 views

Minimum version for syscall clone

Which was the first linux-kernel version to implement the system call clone? (sys_clone)
3
votes
3answers
312 views

Minimum version for syscall write

Which is the first version of the linux-kernel implementing the system call write? (sys_write)
1
vote
1answer
249 views

Minimum version for syscall nanosleep

Which is the minimum version of the linux-kernel implementing the system call nanosleep? (sys_nanosleep)
2
votes
1answer
3k views

Why don't Linux utils use a system call to get the current time?

I'm really trying to understand why our guest VMs aren't using the kvm-clock driver "like they're supposed to". They're running RHEL 7.2, glibc-2.17, kern 3.10.0. Programs such as date and perl -e '...