Questions tagged [system-calls]

Questions concerning the details of how a program uses system calls to interact with the kernel API, what calls are available, how they work etc.

0
votes
1answer
19 views

Accessing the output of the Network Interface Card

I am working on a project in which I need to interface directly with the WLAN Network Interface card, i.e., using the drivers of course. It is lot like wireshark. Also, I want to send some custom ...
-1
votes
1answer
42 views

How a file system recognized by an OS? What is the role of an OS in file-systems? [closed]

I want to understand the medium between a file system & an operating system. Does the operating system take care of any file manipulations?
9
votes
2answers
1k views

Why are there no file insertion syscalls

To my understanding, for manipulating files there is only the sys_write syscall in Linux, which overwrites the file content (or extends it, if at the end). Why are there no syscalls for inserting or ...
2
votes
0answers
50 views

Atomic write and tell for files in O_APPEND mode on linux

I am dealing with a situation where I want to save state persistently for an application that has many processes and many threads within those processes. Normally this would require a heavy use of ...
1
vote
0answers
23 views

sys_open is not exported but it is in /proc/kallsyms

I am currently studying about kernel programming. Currently using Linux Kernel Version 3.13.0 on Ubuntu 14.04.1 I have confusion where sys_open appears when I run the command cat /proc/kallsyms | ...
0
votes
0answers
90 views

execve(2) not launching system commands

I am trying to implement a container, and for that I create a process using the clone(2) system call with the appropriate flags: if ((child_pid = clone(child_main, process_struct.Stack + ...
0
votes
1answer
35 views

pivot_root(2) causes system crash

I am trying to change the root of my process to new file system that I mounted at /tmp/mount_dir and i have created another directory inside it /tmp/mount_dir/inner_mount_dir, and according to the man ...
1
vote
1answer
71 views

Invalid arguments when mounting with MS_SHARED

I am trying to mount the ext4 file system on /mnt into mount_dir which is a temporary directory I created using mkdtemp(2) with MS_SHARED then a remount with MS_PRIVATE, The idea is creating a mount ...
0
votes
0answers
40 views

How does bash implement the “|” operator? [duplicate]

I have a question regarding the pipe operator ("|"). How does bash connect the output of one command or process to the input of another? Is it using the pipe system call or some other way? A sample ...
5
votes
1answer
356 views

Change format of syscall event trace output to ftrace

I enabled ftrace event tracing for sys_enter_openat syscall. The respective output format given at events/syscalls/sys_enter_openat/format is print fmt: "dfd: 0x%08lx, filename: 0x%08lx, flags: 0x%...
2
votes
1answer
87 views

How Linux finds out about illegal memory access error?

I have a question about how Linux traps memory access errors. As far as I know, a user space program doesn't need to ask operating system every time it wants to access memory, now when the process ...
0
votes
0answers
40 views

What's the implementation of system call interruption? Why system call can be interrupted by signals? [duplicate]

As I have read from the book Computer Science: from A Programmer's Perspective, received signals are handled at the moment process shifts from kernel mode to user mode, usually returning from a system ...
1
vote
2answers
795 views

What is interrupted system call?

I am reading APUE and the Interrupted System Calls chapter confuses me. I would like to write down my understanding based on the book, please correct me. A characteristic of earlier UNIX systems ...
2
votes
1answer
27 views

Other permissions apart from filesystem access

Quoted from this answer about the difference between filesystem user id and effective user id of a process, it says that The FSUID is used for filesystem accesses, the EUID for other things. What ...
0
votes
2answers
46 views

Can one processes have a descriptor that is non-blocking while another process have a descriptor referencing the same file/socket that is blocking?

I am more interested in sockets than regular files, but basically I want to know whether one process can "see" a socket as blocking where another process can see it as non-blocking. I am guessing yes,...
0
votes
1answer
27 views

How to lock some resource in a shared network namespace

I would like to implement the functionality similar to pid file but for network namespace. In common file namespace the process can lock pid file and ensure that no other process is running in the ...
1
vote
1answer
32 views

Can I stop a system call before it is executed using Stackable Filesystems? [closed]

Let's assume that I have an application X. I only track system calls that X issues. For example in systems like "CS-STILo". The system detects anomalous sequences of system calls to detect code reuse ...
1
vote
1answer
52 views

MacOS's counterpart to Linux's unshare(2)

Does MacOS have a counterpart to Linux's unshare(2)? I'd like for the following to fail on both systems. #define _GNU_SOURCE #include <stdlib.h> #include <sched.h> int main() { #if ...
0
votes
1answer
64 views

How does Linux knows if a process is allowed to issue a system call?

Let's say that a process wants to issue a system call that can only be issued by a privileged process. How does Linux knows whether to allow the process to issue such system call or not, does Linux ...
1
vote
1answer
20 views

How do I run multiple processes with the same process group id?

I am learning how to use the killpg syscall. So for an experiment, I want to start two new processes with the same pgid and then attempt to kill them using killpg. I read about setsid so I tried ...
1
vote
1answer
104 views

Shell crash and how to debug it

As part of my C application running on Linux, I call a script using the system( ) library function. This script does a umount of a connected USB flash drive. Very rarely (1 in 7-8k) iterations, I see ...
0
votes
1answer
108 views

Read arbitrary amount of memory with process_vm_readv

For process_vm_readv the linux man page states: [...] (Avoid) spanning memory pages (typically 4KiB) in a single remote iovec element. (Instead, split the remote read into two remote_iov elements ...
3
votes
1answer
478 views

Determine free space available on a USB flash drive in C (linux)

I would like to figure out the available free space on a USB flash drive in a C program in Linux. I have earlier used system("df -h /dev/sda1") to figure it out but using system command in a Linux C ...
1
vote
1answer
152 views

How should I pass 32-bit arguments to Linux syscalls on x86_64?

If a syscall needs some 32-bit arguments like uid_t or int (for file descriptors) or unsigned int or even some 16-bit type, how can I pass them using 64-bit registers? Do I need to zero-extend or ...
1
vote
2answers
70 views

How does mmap work with x32 ABI?

I'm looking at Linux 5.0-rc5 source code in arch/x86/entry/syscalls/syscall_64.tbl, find that there's no separate syscall number for x32 mmap. So how does the kernel know we're using the x32 ABI in ...
1
vote
1answer
102 views

how was the pipe(2) system call working in “traditional” Unix

This is what perldoc -f syscall says: There's a problem with syscall(SYS_pipe()): it returns the file number of the read end of the pipe it creates, but there is no way ...
1
vote
1answer
138 views

How does `execve()` call a special start-up routine and the main() function?

When a C program is executed by the kernel—by execve(), where does execve() call a special start-up routine crt0 which is called before the main function is called? where does execve() call ...
0
votes
0answers
196 views

Chrooted upload-only SFTP account - what requests to blacklist/whitelist?

I'm trying to make a chrooted SFTP account which could allow only upload of files into an unique directory - ie. /upload/$timestamp. Let's imagine that it is a shared upload account where one can ...
0
votes
0answers
62 views

Communicating between userland and kernel space (KEXT) on MacOS

In order to make it easier to develop a kernel module, I am considering Loadable kernel modules (LKMs) on MacOS. This way you have a base kernel module and your main kernel module which is an LKM ...
5
votes
0answers
88 views

How to compare string values with seccomp?

Some Linux system calls (such as execve, openat) have string type arguments. But the comparison function SCMP_CMP provided by seccomp seems to be comparing two pointers. So how can I limit files that ...
-8
votes
1answer
110 views

How can we tell if a signal can interrupt the execution of a system call?

From The Linux Programming Interface a signal is delivered at one of the following times: when the process is rescheduled after it earlier timed out (i.e., at the start of a time slice); or ...
1
vote
1answer
82 views

Run program and intercept and redirect syscalls

I would like to run a program, and when that program attempts to read a specific file, I would like it to read a different file of my choosing instead. Specifically, the program attempts to read a ...
1
vote
1answer
471 views

Is there a way to prevent sigkill to reach a process?

I know that a process cannot prevent SIGKILL. But is there an external way to temporarily prevent SIGKILL to reach a (specific) process? (something like dropping packets by firewalls).
0
votes
1answer
44 views

nautilus not call write system call when paste file

I'm trying to hook some system calls using linux kernel module on Ubuntu 14.04 Desktop version. However, when I hooked write(unsigned int fd, const char __user *buf, size_t count) and turned fd into ...
2
votes
1answer
60 views

What system call does Evince use to open pdf?

I have tried to hook system calls using linux kernel module. However, when I open a pdf file using Evince, I find no open,read and write is used on this specific file, only lstat is used. Here is ...
1
vote
0answers
47 views

Does every syscall require at most 1 capability on Linux?

I am trying to understand the relationship between capabilities and syscalls on Linux. As far as I know, the capabilities of a process are only ever considered when that process calls a syscall. When ...
1
vote
1answer
147 views

create a vdso in linux [closed]

I'm currently trying to implement my own VDSO. I have seen this tutorial which explains how to do this. However, this tutorial is made for Linux 2.6.x and I would like to use it on Linux 4.8.x. But ...
3
votes
1answer
145 views

Atomically write a file without changing inodes (preserve hard link)

The normal way to safely, atomically write a file X on Unix is: Write the new file contents to a temporary file Y. rename(2) Y to X In two steps it appears that we have done nothing but change X "...
2
votes
0answers
107 views

How do I make my own Linux system call output to the process's terminal instead of to the kernel log?

I wrote a system call that outputs system information to the kernel log. Here is an example program that invokes my system call. #include <stdio.h> #include <linux/unistd.h> int main() { ...
-2
votes
1answer
423 views

Is every system call an atomic operation? [closed]

APUE says We saw another example of an atomic operation when we described the O_CREAT and O_EXCL options for the open function. When both of these options are specified, the open will fail if ...
1
vote
1answer
770 views

Why can the kernel not use SSE/AVX registers and instructions?

This post from StackOverflow has this, In some environments there there is a restriction on certain instructions or using certain registers. For example, in the Linux kernel, use of SSE/AVX or FP ...
6
votes
2answers
75 views

Is it normal that bash stat() and access() much, before commands?

Running strace on the bash shell that is instructed to run mkdir provided this output which shows lots of stats prior to execve the actual mkdir binary: BASH$> strace -f sh -c "bash -c \"mkdir /...
3
votes
0answers
56 views

What subset of Linux does recent WSL support? [closed]

I know well Linux but nothing about WSL or Windows. I'm using Linux since 1993, but I never used Windows (and probably won't use it before my retirement, e.g. before 2024, so I am likely to never use ...
1
vote
1answer
96 views

What does SYSENTER do in 64-bit Long mode on Linux?

There is an x86 instruction sysenter. This seems to be the Intel fast-system-call method. SYSENTER seems to be valid in LONG mode (64-bit) on Intel processors. This seems to have fallen out of favor ...
10
votes
3answers
2k views

What is the time unit that strace uses when displaying time spent in syscalls?

When using the command strace with the flag -T, I would like to know what is the time unit used to display time spent in syscalls? I assume it should be in seconds, but I am not quite sure and it ...
3
votes
1answer
341 views

Why I can not drop sudo root privileges?

I am debugging a program and not quite sure why I can not drop privileges. I have root permissions via sudo and I can call setgid/setuid, but the operation [is] is not supported. Basic code to ...
7
votes
2answers
1k views

Why is there no apparent clone or fork in simple bash command and how it's done?

Consider the following (with sh being /bin/dash): $ strace -e trace=process sh -c 'grep "^Pid:" /proc/self/status /proc/$$/status' execve("/bin/sh", ["sh", "-c", "grep \"^Pid:\" /proc/self/status /".....
0
votes
1answer
265 views

Knowing when a write() on a serial port has finished transmitting data

I need to synchronize an IO pin value with a write to a serial port from user space (because I wasn't yet able to do it from kernel space - see my other question). My code (leaving out error checking) ...