linux operating-systems

System Call

syscall kernel linux strace userspace
Plain English

A system call is how an app asks the operating system for help. Programs are not allowed to touch the disk, network, or other programs directly. When an app needs to save a file or open a web page, it makes a request to the kernel, and the kernel does the work and hands back the result. Every action you take on a computer turns into many of these requests.

Technical Definition

A system call (syscall) is a controlled transition from user mode into kernel mode. The program places a syscall number and arguments in CPU registers and executes a special instruction (syscall on x86-64, svc on ARM64). The kernel runs the handler and returns a result.

Common Linux syscalls:

  • Files: openat, read, write, close, stat
  • Processes: clone/fork, execve, wait4, exit_group
  • Memory: mmap, brk
  • Network: socket, connect, sendto, recvfrom
  • Permissions: setuid, capset

Errors: a failing syscall returns -1 and sets errno. Messages like Permission denied (EACCES), No such file or directory (ENOENT), and Too many open files (EMFILE) come straight from errno values.

The C library wraps them. printf eventually calls write; fopen calls openat. Linux has around 450 syscalls on x86-64.

Security tie-in: seccomp filters restrict which syscalls a process may make, which is how Docker and systemd sandbox services.

Source: syscalls(2) Linux manual page

Watching system calls with strace 

$ sudo apt install strace

# Every syscall a command makes
$ strace -f cat /etc/hostname 2>&1 | tail -5
openat(AT_FDCWD, "/etc/hostname", O_RDONLY) = 3
read(3, "lab\n", 131072)                 = 4
write(1, "lab\n", 4)                     = 4
close(3)                                = 0

# Only failures, to see why something cannot open a file
$ strace -e trace=openat -Z ls /root 2>&1
openat(AT_FDCWD, "/root", ...) = -1 EACCES (Permission denied)

# Summary count by syscall
$ strace -c -f curl -s https://bytesnation.com > /dev/null
In the Wild

When an app fails with a vague message, strace shows exactly which file it tried to open, which permission it lacked, or which network call hung. It is one of the fastest ways to debug a missing config file or a wrong path. Understanding syscalls also explains error messages: most Linux errors are errno names surfaced by whatever program you ran.

← Back to Dictionary