Questions tagged [system-calls]

Questions concerning the details of how a program uses system calls to interact with the kernel API, what calls are available, how they work etc.

Filter by
Sorted by
Tagged with
0
votes
0answers
12 views

Linux kernel process execution with logging all IO

Is there option to have sort of proxy on executing binary file, that reads and handles all it's syscalls? I know it's KVM, but I need to access this data on what application is doing, is there open ...
45
votes
4answers
6k views

How does a linux GUI work at the lowest level?

I'm basically trying to figure out how one would go about making a GUI from absolute scratch with nothing but the linux kernel and programming in C. I am not looking to create a GUI desktop ...
2
votes
1answer
31 views

Question about a process lifecycle

I've managed to question myself about the wait(2) and _exit(2) system calls in a process lifecycle. My question about the wait(2) system call is... does the parent process issue it to the kernel? Or ...
3
votes
1answer
98 views

strace all but specified system calls

How can I run strace, and record all of syscall , but not read and not write?
2
votes
1answer
131 views

problem understanding system(“/bin/sh”)

I'm having problems understanding why this program #include <stdio.h> #include <stdlib.h> int main() { int iRetval = 0; unsigned int uiNum; printf("Enter number: "); ...
0
votes
1answer
95 views

Why we need to set no_new_privs while before calling SECCOMP_MODE_FILTER?

At the man page I read the following line: cause an attempt to use setuid(2) to set the caller's user IDs to nonzero values to instead return 0 without actually making the system call I can't ...
0
votes
0answers
55 views

How to intercept any call to the kernel to spawn a process

I am attempting to make a program that is a system security watchdog. Any processes or ports that are not supposed to be open will be closed by the watchdog to mitigate a breech in security. I'm ...
0
votes
0answers
47 views

Can kernel guarantee that POSIX close frees the descriptor?

Linux developers argue that it's pointless to retry close operation in case of an error, since the kernel "always releases the file descriptor early" (emphasis mine). While in general fildes state ...
0
votes
2answers
44 views

Cryptography and the kernel, System calls

Is cryptography implemented in user space or kernel space? Are public/private key pairs generated in the kernel space? What about encryption or decryption using a given public key or a given private ...
0
votes
1answer
230 views

How to use sys_read() in kernel space properly

I wrote a system call that searches for the given input in a file. But my code is not working because sys_read() is not working. #include <linux/kernel.h> #include <linux/unistd.h> #...
1
vote
1answer
114 views

hrtimer_nanosleep explanation

I have searched the Internet and did not find any explanation for hrtimer_nanosleep. What is the usage of this function and how does it differ from the clock_nanosleep API? Can someone please explain ...
0
votes
0answers
25 views

Locating the system call table by means of the IDT and the syscall handler fails?

I'm working on an assignment for kernel programming classes and I need to locate the system_call_table memory address by means of the IDT and the system call handler. I've found numerous examples on ...
2
votes
0answers
45 views

sendfile doesn't work for empty stdin

Output from strace for non-empty stdin: execve("./cat", ["./cat"], 0x7fff610af090 /* 37 vars */) = 0 sendfile(1, 0, NULL, 1048576) = 4 sendfile(1, 0, NULL, 1048576) = 0 close(0) ...
0
votes
0answers
146 views

why are there so many mmap system call in strace?

I am trying to understand strace command. I started by using strace on some basic commands as shown below. [root@localhost]# strace ls execve("/bin/ls", ["ls"], 0x7ffd79175190 /* 27 vars */) = 0 brk(...
3
votes
1answer
44 views

Why is this code exiting with return code 16?

I am trying my hands on clone() system call to create a Thread. However program is terminating itself as it return from t2_thread() function. Why is this behaviour? What am I missing? #define ...
1
vote
0answers
27 views

System call time measurement

I have implemented a data copying loop using system functions write() and read() if -s command is used or C library functions if -l otherwise. I am trying to measure the time for the system call ...
-1
votes
1answer
69 views

How to break down signal system call prototype in Linux?

I am reading "The Linux Programming Interface", where I find signal system call prototype as stated: #include <signal.h> void ( *signal(int sig, void (*handler)(int)) ) (int); What is signal ...
0
votes
1answer
95 views

What is included in the syscall.h in Linux?

I am compiling a set of native binaries from source for AIX 7.1. The source code references the sys/syscall.h header which is present in Linux but not for AIX. On digging through the raw code, this ...
1
vote
1answer
177 views

If the kernel can sleep when handling a system call, how does execution return to the system call?

I am reading "Linux Kernel Development" by Robert Love and he wrote that the system call executes in process context and is capable of sleeping. The current pointer will refer to the current task, ...
2
votes
0answers
52 views

How to trace script execution events

My goal: To receive events from the kernel when a file/script is opened for execution with the absolute path of the file (or maybe the working directory, to resolve the absolute path of the file). I ...
2
votes
0answers
56 views

Is there a syscall to move memory back from swap to RAM?

I am wondering, is there a syscall, or has this ever been discussed, to move memory pages from swap back to RAM, given there is enough free RAM? I am thinking of something like the infamous swapoff -...
0
votes
1answer
42 views

Is a single big read/write request to the operating system less expensive than multiple small read/write requests?

According to the official documentation, one of the reasons why Java implements Buffered Streams is Most of the examples we've seen so far use unbuffered I/O. This means each read or write request ...
2
votes
0answers
36 views

utimes() and utimensat() syscalls hangs for 90 sec

CentOS 7.6, xfs filesystem: We observe hanging backup and compile jobs because utimes() and utimensat() syscalls hang on random files for 90 sec. xfs mount options are rw,relatime,attr2,inode64,...
0
votes
1answer
28 views

How is FreeBSDs/DragonFlyBSD sendfile() system call supposed to work?

sendfile() The offset argument is of type off_t and nbytes is of type size_t while both are describing the same thing: a file length. What if my file is longer than off_t but shorter than size_t? If ...
3
votes
1answer
286 views

Why does glibc need kernel headers?

Why do programs like glibc need the Linux Kernel headers? The Linux API is provided via syscalls, and other libc implementations such as musl do not require these headers. What makes glibc special?
2
votes
1answer
49 views

auditctl - logging the CPU or identifier of pthread that invoked the system call

auditctl is a great utility for monitoring many things, such as executed system calls. I would ideally like to know either the CPU or the POSIX thread that instantiated each recorded system call. In ...
1
vote
0answers
170 views

Source code line from BUG: unable to handle kernel NULL pointer dereference at

I am debugging a custom system call I wrote, and I keep seeing this error in the kernel log: "BUG: unable to handle kernel NULL pointer dereference at (number)". Is there a way to derive the source ...
2
votes
2answers
132 views

Why does strace show that syscall =?

I made a system call and recompiled the kernel, however upon running the system call it returned Killed. So, to trace it, I used strace, which shows the following message: syscall_0x224(0x7ffda7199738,...
0
votes
1answer
22 views

Accessing the output of the Network Interface Card

I am working on a project in which I need to interface directly with the WLAN Network Interface card, i.e., using the drivers of course. It is lot like wireshark. Also, I want to send some custom ...
-1
votes
1answer
58 views

How a file system recognized by an OS? What is the role of an OS in file-systems? [closed]

I want to understand the medium between a file system & an operating system. Does the operating system take care of any file manipulations?
11
votes
2answers
2k views

Why are there no file insertion syscalls

To my understanding, for manipulating files there is only the sys_write syscall in Linux, which overwrites the file content (or extends it, if at the end). Why are there no syscalls for inserting or ...
3
votes
0answers
159 views

Atomic write and tell for files in O_APPEND mode on linux

I am dealing with a situation where I want to save state persistently for an application that has many processes and many threads within those processes. Normally this would require a heavy use of ...
1
vote
0answers
70 views

sys_open is not exported but it is in /proc/kallsyms

I am currently studying about kernel programming. Currently using Linux Kernel Version 3.13.0 on Ubuntu 14.04.1 I have confusion where sys_open appears when I run the command cat /proc/kallsyms | ...
0
votes
0answers
292 views

execve(2) not launching system commands

I am trying to implement a container, and for that I create a process using the clone(2) system call with the appropriate flags: if ((child_pid = clone(child_main, process_struct.Stack + ...
0
votes
1answer
58 views

pivot_root(2) causes system crash

I am trying to change the root of my process to new file system that I mounted at /tmp/mount_dir and i have created another directory inside it /tmp/mount_dir/inner_mount_dir, and according to the man ...
1
vote
1answer
218 views

Invalid arguments when mounting with MS_SHARED

I am trying to mount the ext4 file system on /mnt into mount_dir which is a temporary directory I created using mkdtemp(2) with MS_SHARED then a remount with MS_PRIVATE, The idea is creating a mount ...
0
votes
0answers
47 views

How does bash implement the “|” operator? [duplicate]

I have a question regarding the pipe operator ("|"). How does bash connect the output of one command or process to the input of another? Is it using the pipe system call or some other way? A sample ...
5
votes
1answer
489 views

Change format of syscall event trace output to ftrace

I enabled ftrace event tracing for sys_enter_openat syscall. The respective output format given at events/syscalls/sys_enter_openat/format is print fmt: "dfd: 0x%08lx, filename: 0x%08lx, flags: 0x%...
2
votes
1answer
212 views

How Linux finds out about illegal memory access error?

I have a question about how Linux traps memory access errors. As far as I know, a user space program doesn't need to ask operating system every time it wants to access memory, now when the process ...
0
votes
0answers
44 views

What's the implementation of system call interruption? Why system call can be interrupted by signals? [duplicate]

As I have read from the book Computer Science: from A Programmer's Perspective, received signals are handled at the moment process shifts from kernel mode to user mode, usually returning from a system ...
2
votes
2answers
8k views

What is interrupted system call?

I am reading APUE and the Interrupted System Calls chapter confuses me. I would like to write down my understanding based on the book, please correct me. A characteristic of earlier UNIX systems ...
2
votes
1answer
33 views

Other permissions apart from filesystem access

Quoted from this answer about the difference between filesystem user id and effective user id of a process, it says that The FSUID is used for filesystem accesses, the EUID for other things. What ...
0
votes
2answers
83 views

Can one processes have a descriptor that is non-blocking while another process have a descriptor referencing the same file/socket that is blocking?

I am more interested in sockets than regular files, but basically I want to know whether one process can "see" a socket as blocking where another process can see it as non-blocking. I am guessing yes,...
0
votes
1answer
43 views

How to lock some resource in a shared network namespace

I would like to implement the functionality similar to pid file but for network namespace. In common file namespace the process can lock pid file and ensure that no other process is running in the ...
0
votes
1answer
56 views

Can I stop a system call before it is executed using Stackable Filesystems? [closed]

Let's assume that I have an application X. I only track system calls that X issues. For example in systems like "CS-STILo". The system detects anomalous sequences of system calls to detect code reuse ...
1
vote
1answer
217 views

MacOS's counterpart to Linux's unshare(2)

Does MacOS have a counterpart to Linux's unshare(2)? I'd like for the following to fail on both systems. #define _GNU_SOURCE #include <stdlib.h> #include <sched.h> int main() { #if ...
0
votes
1answer
128 views

How does Linux knows if a process is allowed to issue a system call?

Let's say that a process wants to issue a system call that can only be issued by a privileged process. How does Linux knows whether to allow the process to issue such system call or not, does Linux ...
1
vote
1answer
106 views

How do I run multiple processes with the same process group id?

I am learning how to use the killpg syscall. So for an experiment, I want to start two new processes with the same pgid and then attempt to kill them using killpg. I read about setsid so I tried ...
1
vote
1answer
274 views

Shell crash and how to debug it

As part of my C application running on Linux, I call a script using the system( ) library function. This script does a umount of a connected USB flash drive. Very rarely (1 in 7-8k) iterations, I see ...
1
vote
1answer
350 views

Read arbitrary amount of memory with process_vm_readv

For process_vm_readv the linux man page states: [...] (Avoid) spanning memory pages (typically 4KiB) in a single remote iovec element. (Instead, split the remote read into two remote_iov elements ...

1
2 3 4 5 6