https://lesitedefrancois.be/en/tags/os/Recent content in Os on Le Site de FrançoisHugo -- gohugo.ioen© 2026 Françoishttps://lesitedefrancois.be/en/security/syscall/Mon, 01 Jan 0001 00:00:00 +0000https://lesitedefrancois.be/en/security/syscall/<p>A <strong>system call (syscall)</strong> is the formal interface through which a user-space process asks the kernel to perform a privileged operation on its behalf — opening a file, allocating memory, creating a process, establishing a network connection, sending a signal, or any other action that requires kernel mediation. User-space code runs at CPU privilege level 3 (ring 3) and cannot directly access hardware, manipulate kernel data structures, or perform I/O; the kernel runs at ring 0 with unrestricted access. A syscall is the crossing point: the process places its request in a defined register convention and issues a <code>syscall</code> instruction (on x86-64) that atomically switches the CPU to ring 0 and transfers control to the kernel&rsquo;s syscall dispatch table. The kernel validates the request, performs the operation if permitted by standard Unix permissions and any active <strong>LSM</strong> hooks, and returns the result. From a security perspective, the syscall boundary is the complete list of what a process can ask the kernel to do — and therefore the complete list of operations that security controls like <strong>seccomp</strong> and <strong>BPF LSM</strong> can police.</p>