Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [system-calls]

Questions concerning the details of how a program uses system calls to interact with the kernel API, what calls are available, how they work etc.

0
votes
0answers
13 views

I want ideas to trace which app is rebooting my android [migrated]

Some process is rebooting my phone every time it connects to Wi-Fi. I thought of connecting it to the PC and do an strace in init or zygote or the system server, but I don't know what to look for in ...
0
votes
0answers
81 views

execve(2) not launching system commands

I am trying to implement a container, and for that I create a process using the clone(2) system call with the appropriate flags: if ((child_pid = clone(child_main, process_struct.Stack + ...
0
votes
1answer
26 views

pivot_root(2) causes system crash

I am trying to change the root of my process to new file system that I mounted at /tmp/mount_dir and i have created another directory inside it /tmp/mount_dir/inner_mount_dir, and according to the man ...
1
vote
1answer
68 views

Invalid arguments when mounting with MS_SHARED

I am trying to mount the ext4 file system on /mnt into mount_dir which is a temporary directory I created using mkdtemp(2) with MS_SHARED then a remount with MS_PRIVATE, The idea is creating a mount ...
0
votes
0answers
40 views

How does bash implement the “|” operator? [duplicate]

I have a question regarding the pipe operator ("|"). How does bash connect the output of one command or process to the input of another? Is it using the pipe system call or some other way? A sample ...
5
votes
1answer
219 views

Change format of syscall event trace output to ftrace

I enabled ftrace event tracing for sys_enter_openat syscall. The respective output format given at events/syscalls/sys_enter_openat/format is print fmt: "dfd: 0x%08lx, filename: 0x%08lx, flags: 0x%...
2
votes
1answer
71 views

How Linux finds out about illegal memory access error?

I have a question about how Linux traps memory access errors. As far as I know, a user space program doesn't need to ask operating system every time it wants to access memory, now when the process ...
0
votes
0answers
39 views

What's the implementation of system call interruption? Why system call can be interrupted by signals? [duplicate]

As I have read from the book Computer Science: from A Programmer's Perspective, received signals are handled at the moment process shifts from kernel mode to user mode, usually returning from a system ...
0
votes
2answers
389 views

What is interrupted system call?

I am reading APUE and the Interrupted System Calls chapter confuses me. I would like to write down my understanding based on the book, please correct me. A characteristic of earlier UNIX systems ...
2
votes
1answer
27 views

Other permissions apart from filesystem access

Quoted from this answer about the difference between filesystem user id and effective user id of a process, it says that The FSUID is used for filesystem accesses, the EUID for other things. What ...
0
votes
1answer
26 views

How to lock some resource in a shared network namespace

I would like to implement the functionality similar to pid file but for network namespace. In common file namespace the process can lock pid file and ensure that no other process is running in the ...
1
vote
1answer
31 views

Can I stop a system call before it is executed using Stackable Filesystems? [closed]

Let's assume that I have an application X. I only track system calls that X issues. For example in systems like "CS-STILo". The system detects anomalous sequences of system calls to detect code reuse ...
1
vote
1answer
45 views

MacOS's counterpart to Linux's unshare(2)

Does MacOS have a counterpart to Linux's unshare(2)? I'd like for the following to fail on both systems. #define _GNU_SOURCE #include <stdlib.h> #include <sched.h> int main() { #if ...
0
votes
1answer
62 views

How does Linux knows if a process is allowed to issue a system call?

Let's say that a process wants to issue a system call that can only be issued by a privileged process. How does Linux knows whether to allow the process to issue such system call or not, does Linux ...
1
vote
1answer
97 views

Shell crash and how to debug it

As part of my C application running on Linux, I call a script using the system( ) library function. This script does a umount of a connected USB flash drive. Very rarely (1 in 7-8k) iterations, I see ...
3
votes
1answer
453 views

Determine free space available on a USB flash drive in C (linux)

I would like to figure out the available free space on a USB flash drive in a C program in Linux. I have earlier used system("df -h /dev/sda1") to figure it out but using system command in a Linux C ...
1
vote
1answer
94 views

how was the pipe(2) system call working in “traditional” Unix

This is what perldoc -f syscall says: There's a problem with syscall(SYS_pipe()): it returns the file number of the read end of the pipe it creates, but there is no way ...
1
vote
1answer
124 views

How does `execve()` call a special start-up routine and the main() function?

When a C program is executed by the kernel—by execve(), where does execve() call a special start-up routine crt0 which is called before the main function is called? where does execve() call ...
-8
votes
1answer
96 views

How can we tell if a signal can interrupt the execution of a system call?

From The Linux Programming Interface a signal is delivered at one of the following times: when the process is rescheduled after it earlier timed out (i.e., at the start of a time slice); or ...
0
votes
1answer
44 views

nautilus not call write system call when paste file

I'm trying to hook some system calls using linux kernel module on Ubuntu 14.04 Desktop version. However, when I hooked write(unsigned int fd, const char __user *buf, size_t count) and turned fd into ...
2
votes
1answer
56 views

What system call does Evince use to open pdf?

I have tried to hook system calls using linux kernel module. However, when I open a pdf file using Evince, I find no open,read and write is used on this specific file, only lstat is used. Here is ...
1
vote
1answer
130 views

create a vdso in linux [closed]

I'm currently trying to implement my own VDSO. I have seen this tutorial which explains how to do this. However, this tutorial is made for Linux 2.6.x and I would like to use it on Linux 4.8.x. But ...
3
votes
1answer
130 views

Atomically write a file without changing inodes (preserve hard link)

The normal way to safely, atomically write a file X on Unix is: Write the new file contents to a temporary file Y. rename(2) Y to X In two steps it appears that we have done nothing but change X "...
2
votes
0answers
102 views

How do I make my own Linux system call output to the process's terminal instead of to the kernel log?

I wrote a system call that outputs system information to the kernel log. Here is an example program that invokes my system call. #include <stdio.h> #include <linux/unistd.h> int main() { ...
-2
votes
1answer
383 views

Is every system call an atomic operation? [closed]

APUE says We saw another example of an atomic operation when we described the O_CREAT and O_EXCL options for the open function. When both of these options are specified, the open will fail if ...
3
votes
0answers
55 views

What subset of Linux does recent WSL support? [closed]

I know well Linux but nothing about WSL or Windows. I'm using Linux since 1993, but I never used Windows (and probably won't use it before my retirement, e.g. before 2024, so I am likely to never use ...
1
vote
1answer
91 views

What does SYSENTER do in 64-bit Long mode on Linux?

There is an x86 instruction sysenter. This seems to be the Intel fast-system-call method. SYSENTER seems to be valid in LONG mode (64-bit) on Intel processors. This seems to have fallen out of favor ...
10
votes
3answers
2k views

What is the time unit that strace uses when displaying time spent in syscalls?

When using the command strace with the flag -T, I would like to know what is the time unit used to display time spent in syscalls? I assume it should be in seconds, but I am not quite sure and it ...
3
votes
1answer
272 views

Why I can not drop sudo root privileges?

I am debugging a program and not quite sure why I can not drop privileges. I have root permissions via sudo and I can call setgid/setuid, but the operation [is] is not supported. Basic code to ...
3
votes
1answer
160 views

Why do strace and ltrace cause EINTR to happen?

Consider this program: #include <stdio.h> #include <sys/epoll.h> int main(void) { int epfd = epoll_create1(0); struct epoll_event event; event.events = EPOLLIN; ...
3
votes
1answer
680 views

Why execve and brk(NULL) are always the first two system calls?

When I try strace ping google.com or strace ls or even strace curl <domain> The first two systemcalls are always, execve("/usr/bin/curl", ["curl", "google.com"], 0x7ffecf1bc378 /* 61 ...
0
votes
2answers
472 views

pass stdout fd to 'read' system call, but it still works fine [duplicate]

I pass 1(stdout)/2(stderr) to read system call but it still works fine. Then I pass 0(stdin) to write system call and find out it works too! int main(int argc, char** argv){ char buf[1024] = "...
1
vote
1answer
271 views

How can I make a specific process exec a given executable with ptrace()?

I am trying to force the init process of an embedded Linux system to exec() my own init program (systemd) so that I can test an external filesystem before writing it to the system's flash (and risk ...
0
votes
1answer
610 views

Are system calls stored in registers? [closed]

I saw a video on youtube where the system calls were present for each register. So does that mean system calls are stored in registers? If it is so how is this possible, I mean They are accessed by ...
1
vote
1answer
411 views

How does FIO benchmark set IOdepth?

NOTE: My question stems from this other U&L Q - What exactly is iodepth in fio? I want to know how internally FIO sets I/O depth. I.e., one of the parameters we submit to FIO when we run it is "...
0
votes
1answer
292 views

Why could a call to `getaddrinfo()` fail with `EAI_SYSTEM` and errno set to `EBUSY` (“Device or resource busy”)?

I'm seeing this error when running apt update in containers, if that is useful information. apt spits out: System error resolving 'archive.ubuntu.com:80' - getaddrinfo (16: Device or resource busy) ...
1
vote
1answer
70 views

SystemCallFilter apparently not taken into account

I am trying to harden some services on my servers. For this purpose, I have been using systemctl service configuration. For a given service, I run for instance strace to determine the system calls ...
3
votes
1answer
249 views

Why is the “open” system call not featured in /usr/include/unistd.h ? (but “close” is)

In my comprehension the open and the close system call seem very much related. both deal with files available in most all unix flavours (?any unix that does not feature them existed?) I therefore ...
2
votes
1answer
319 views

Does my Linux system support the 32-bit syscall table?

The context is the following: Additionally, the following rule is required in systems supporting the 32-bit syscall table (such as i686 and x86_64). I'm trying to figure out what this means, and ...
0
votes
2answers
189 views

Use waitpid for child having groupid 1

I searched a lot but didn't find a solution. So it can be silly question. The format of waitpid is pid_t waitpid (pid_t pid, int *status, int options) The pid parameter specifies exactly which ...
5
votes
1answer
610 views

From which version does Bash drop privileges?

I've been trying to do some bufferoverflow attack, and I tought I could use system("/bin/bash") in order to obtain a root shell. Then I read the documentation for system(). It says : system() ...
3
votes
1answer
1k views

FreeBSD vs Linux: performance of kernel calling conventions

From int80h.org, the FreeBSD Assembly Language Tutorial [The Linux Calling] convention has a great disadvantage over the Unix way, at least as far as assembly language programming is concerned: ...
0
votes
0answers
55 views

system call to peek next byte from serial port

have a program that does an open() on /dev/ttyACM0. I know how to get bytes available using ioctl(), but I want to know what is the next available byte's value, without grabbing it. (A peek). Is by ...
48
votes
2answers
5k views

What did the system call “tuxcall” do?

In include/x86_64-linux-gnu/asm/unistd_64.h, I see a system call named tuxcall, #define __NR_tuxcall 184 There is nothing about it in man tuxcall except to say that it's an unimplemented system ...
2
votes
1answer
205 views

Does nohup try to arrange for the program not to have a controlling terminal?

Gilles said nohup and disown both can be said to suppress SIGHUP, but in different ways. nohup makes the program ignore the signal initially (the program may change this). nohup also tries to ...
4
votes
1answer
747 views

syscall number → name mapping at runtime

Is there a way to resolve the number of an observed syscall: SYS_345(0xe, 0xbff94188, 0x2, 0x4000, 0xb6526000) = 2 to its symbolic name in the running kernel without looking it up, in the sources? ...
3
votes
1answer
2k views

List of system calls with explanation? [closed]

Where can I find a list of system calls along with what each call does? I am not a C programmer, I am an admin so at times I find it helpful to run an strace on a running process to see what is going ...
2
votes
1answer
82 views

What is the format of the address used by buffer of system call read?

I'm using strace, and the following line appears: read(3,"\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\3\2\0\0\0\0\0@\0\0\0\0\0\00P\265\31\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0G\0F\0\6\0\0\0\5\0\0\0@...
1
vote
0answers
395 views

Shell command on terminal vs system() call

I am using NMAP for port scanning on a host. When I run the following command on terminal, it gives the results within a minute most of the times. $ nmap -p 1-65535 10.180.5.237 | awk --posix '{ ...
2
votes
0answers
94 views

Time lost as pselect system call returns from kernel?

Background: I am using a pselect system call in user-space code to wait on a GPIO pin to toggle. I know that it should take no more than 5 milliseconds for this toggle to occur, and I've verified ...