Skip to content

edigaryev/awesome-system-calls

Repository files navigation

Awesome System Calls

A categorized list of system calls used by popular Unix-like operating systems.

Since the system calls are the primary way of how the OS processes interact with the outside world, this list can be very useful when evaluating what is possible or not on a given operating system.

There are various system call dumps on the internet and attempts to classify and group system calls in various research papers, but it's very hard to find both in the same place. And even if you do, chances are they will be wildly outdated and will only target a single OS.

The awesome word is used deliberately as an alias for "collection of", to help people Googling this project.

System call statistics

  • OpenBSD (🐑) β€” 220

  • Linux (🐧) β€” 354

  • FreeBSD (😈) β€” 392

  • Darwin (🍏) β€” 453

Table of contents

System calls

Processes and threads

Lifecycle

Name OS Description
fork 🐑, 😈, 🍏 create a child process
vfork 🐑, 😈, 🍏 create a child process and block parent
clone 🐧 create a child process or thread
clone3 🐧 create a child process or thread
posix_spawn 🍏 spawn a process
execve 🐑, 🐧, 😈, 🍏 execute a program
execveat 🐧 execute a program (relative to a directory file descriptor)
wait4 🐑, 🐧, 😈, 🍏 wait for process to change state
waitid 🐑, 🐧, 🍏 wait for process to change state
exit 🐑, 🐧, 😈, 🍏 terminate the calling process

Lifecycle (thread-specific)

Name OS Description
tkill 🐧 send a signal to a thread
tgkill 🐧 send a signal to a thread in a thread group
thrkill 🐑 send a signal to a thread
exit_group 🐧 exit all threads in a process's thread group
set_tid_address 🐧 set pointer to a thread ID
__get_tcb 🐑 get the address of the thread control block of the current thread
__set_tcb 🐑 set the address of the thread control block of the current thread
__tfork 🐑 create a new kernel thread in the current process
__thrsleep 🐑 userspace thread sleep
__thrwakeup 🐑 userspace thread wakeup

File system relationships

Name OS Description
getcwd 🐧 get current working directory
__getcwd 🐑, 😈 get current working directory
chdir 🐑, 🐧, 😈, 🍏 set current working directory
fchdir 🐑, 🐧, 😈, 🍏 set current working directory (referenced by a file descriptor)
chroot 🐑, 🐧, 😈, 🍏 change root directory
pivot_root 🐧, 🍏 change root mount
umask 🐑, 🐧, 😈, 🍏 set file creation mode mask
setfsuid 🐧 set user identity used for filesystem checks
setfsgid 🐧 set group identity used for filesystem checks

Credentials

UID
Name OS Description
getuid 🐑, 🐧, 😈, 🍏 get real user ID
setuid 🐑, 🐧, 😈, 🍏 set real user ID
geteuid 🐑, 🐧, 😈, 🍏 get effective user ID
seteuid 🐑, 😈, 🍏 set effective user ID
getresuid 🐑, 🐧, 😈 get real, effective and saved user IDs
setresuid 🐑, 🐧, 😈 set real, effective and saved user IDs
setreuid 🐑, 🐧, 😈, 🍏 set real and effective user IDs
GID
Name OS Description
getgid 🐑, 🐧, 😈, 🍏 get real group ID
setgid 🐑, 🐧, 😈, 🍏 set real group ID
getegid 🐑, 🐧, 😈, 🍏 get effective group ID
setegid 🐑, 😈, 🍏 set effective group ID
getresgid 🐑, 🐧, 😈 get real, effective and saved group IDs
setresgid 🐑, 🐧, 😈 set real, effective and saved group IDs
setregid 🐑, 🐧, 😈, 🍏 set real and effective group IDs
getgroups 🐑, 🐧, 😈, 🍏 get supplementary group IDs
setgroups 🐑, 🐧, 😈, 🍏 set supplementary group IDs
Process groups and sessions
Name OS Description
getpgrp 🐑, 😈, 🍏 get process group
getpgid 🐑, 🐧, 😈, 🍏 get process group (referenced by a process ID)
setpgid 🐑, 🐧, 😈, 🍏 set process group (referenced by a process ID)
getsid 🐑, 🐧, 😈, 🍏 get process session ID
setsid 🐑, 🐧, 😈, 🍏 set process sesssion ID
getlogin_r 🐑 get login name of the user associated with current session
setlogin 🐑, 😈, 🍏 set login name of the user associated with current session

Signals

Name OS Description
kill 🐑, 🐧, 😈, 🍏 send signal to a process
pidfd_send_signal 🐧 send signal to a process (referenced by a file descriptor)
sigaction 🐑, 😈, 🍏 examine and change a signal action
rt_sigaction 🐧 examine and change a signal action
sigaltstack 🐑, 🐧, 😈, 🍏 manipulate signal stack context
sigpending 🐑, 😈, 🍏 examine pending signals
rt_sigpending 🐧 examine pending signals
sigprocmask 🐑, 😈, 🍏 examine and change blocked signals
rt_sigprocmask 🐧 examine and change blocked signals
sigreturn 🐑, 😈, 🍏 return from the signal handler
rt_sigreturn 🐧 return from the signal handler
sigsuspend 🐑, 😈, 🍏 wait for signal
rt_sigsuspend 🐧 wait for signal
rt_sigtimedwait 🐧 synchronously wait for queued signals
rt_sigqueueinfo 🐧 queue a signal and data
rt_tgsigqueueinfo 🐧 queue a signal and data
__thrsigdivert 🐑 synchronously accept a signal

Virtual memory

Allocation and deallocation
Name OS Description
brk 🐧 change data segment size
sbrk 😈 increase data segment size
mmap 🐑, 🐧, 😈, 🍏 map files or devices into memory
mmap2 🐧 map files or devices into memory
mremap 🐧 remap a virtual memory address
remap_file_pages 🐧 create a nonlinear file mapping
munmap 🐑, 🐧, 😈, 🍏 remove a mapping
Locking
Name OS Description
mlock 🐑, 🐧, 😈, 🍏 lock physical pages in memory
mlock2 🐧 lock physical pages in memory
mlockall 🐑, 🐧, 😈, 🍏 lock the address space of a process
mincore 🐧, 😈, 🍏 determine whether pages are resident in memory
munlock 🐑, 🐧, 😈, 🍏 unlock physical pages in memory
munlockall 🐑, 🐧, 😈, 🍏 unlock the address space of a process
Protection
Name OS Description
mprotect 🐑, 🐧, 😈, 🍏 control the protection of pages
minherit 🐑, 😈, 🍏 control the inheritance of pages
mimmutable 🐑 control the immutability of pages
kbind 🐑 update protected memory for lazy-binding
pkey_alloc 🐧 allocate a protection key
pkey_mprotect 🐧 control the protection of pages and their protection keys
pkey_free 🐧 free a protection key
Hints and synchronization
Name OS Description
madvise 🐑, 🐧, 😈, 🍏 give advice about use of memory
process_madvise 🐧 give advice about use of memory to a process
mquery 🐑 provide mapping hints to applications
msync 🐑, 🐧, 😈, 🍏 synchronize a mapped region

Timers

Name OS Description
getitimer 🐑, 🐧, 😈, 🍏 get value of interval timer
setitimer 🐑, 🐧, 😈, 🍏 set value of interval timer
timer_create 🐧 create a POSIX per-process timer
timer_gettime 🐧 fetch state of POSIX per-process timer
timer_settime 🐧 arm/disarm the POSIX per-process timer
timer_getoverrun 🐧 get overrun count for a POSIX per-process timer
timer_delete 🐧 delete a POSIX per-process timer
timerfd_gettime 🐧 fetch state of a timer that notifies via file descriptor
timerfd_settime 🐧 arm/disarm a timer that notifies via file descriptor

Metadata

Name OS Description
getpid 🐑, 🐧, 😈, 🍏 get process ID
getppid 🐑, 🐧, 😈, 🍏 get process ID of the parent
gettid 🐧, 🍏 get thread ID
getthrid 🐑 get thread ID
getthrname 🐑 get thread name
setthrname 🐑 set thread name
issetugid 🐑, 😈, 🍏 check if current executable is running setuid or setgid
personality 🐧 set the process execution domain

CPU and NUMA

Name OS Description
getcpu 🐧 determine CPU and NUMA node on which the calling thread is running
get_mempolicy 🐧 retrieve NUMA memory policy for a thread
set_mempolicy 🐧 set default NUMA memory policy for a thread
mbind 🐧 set memory policy for a memory range
move_pages 🐧 move individual pages of a process to another node
migrate_pages 🐧 move all pages in a process to another set of nodes

Scheduling

Name OS Description
getpriority 🐑, 🐧, 😈, 🍏 get process scheduling priority
setpriority 🐑, 🐧, 😈, 🍏 set process scheduling priority
sched_yield 🐑, 🐧, 😈 yield the processor
sched_getparam 🐧, 😈 get scheduling parameters
sched_setparam 🐧, 😈 set scheduling parameters
sched_getscheduler 🐧, 😈 get scheduling policy/parameters
sched_setscheduler 🐧, 😈 set scheduling policy/parameters
sched_getattr 🐧 get scheduling policy and attributes
sched_setattr 🐧 set scheduling policy and attributes
sched_get_priority_min 🐧, 😈 get static priority range
sched_get_priority_max 🐧, 😈 get static priority range
sched_rr_get_interval 🐧, 😈 get the SCHED_RR interval (referenced by a process ID)
sched_getaffinity 🐧 get thread's CPU affinity mask
sched_setaffinity 🐧 set thread's CPU affinity mask
ioprio_get 🐧 get I/O scheduling class and and priority
ioprio_set 🐧 set I/O scheduling class and and priority

Resource limits and utilization

Name OS Description
getrlimit 🐑, 🐧, 😈, 🍏 get resource limits
setrlimit 🐑, 🐧, 😈, 🍏 set resource limits
prlimit64 🐧 control resource limits (referenced by a process ID)
getrusage 🐑, 🐧, 😈, 🍏 get resource usage
times 🐧 get process times

Terminal

Name OS Description
vhangup 🐧 virtually hangup the current terminal

Network routing

Name OS Description
getrtable 🐑 get default routing table of the current process
setrtable 🐑 set default routing table of the current process

Sleeping

Name OS Description
nanosleep 🐑, 🐧, 😈 high-resolution sleep
clock_nanosleep 🐧, 😈 high-resolution sleep with specifiable clock

Locking and synchronization

Name OS Description
futex 🐑, 🐧 fast userspace locking primitive
futex_waitv 🐧 wait on array of futexes
membarrier 🐧 issue memory barriers on a set of threads
get_robust_list 🐧 get list of robust futexes
set_robust_list 🐧 set list of robust futexes

Operations on other processes and threads

Name OS Description
ktrace 🐑, 😈 configure process tracing
ptrace 🐑, 🐧, 😈, 🍏 configure process tracing
process_vm_readv 🐧 transfer data between process address spaces
process_vm_writev 🐧 transfer data between process address spaces
prctl 🐧 various operations on a process or a thread
kcmp 🐧 compare two processes to determine if they share a kernel resource

File descriptors and handles

Open or create a file

Name OS Description
open 🐑, 😈, 🍏 open or create a file
openat 🐑, 🐧, 😈, 🍏 open or create a file (relative to a directory file descriptor)
openat2 🐧 open or create a file (relative to a directory file descriptor)
getfh 🐑, 😈, 🍏 obtain a handle for a path
name_to_handle_at 🐧 obtain a handle for a path
fhopen 🐑, 😈, 🍏 open file via a handle
open_by_handle_at 🐧 open file via a handle

Create a pipe

Name OS Description
pipe 🐑, 🍏 create a pipe
pipe2 🐑, 🐧, 😈 create a pipe

Open or create something else

Name OS Description
eventfd2 🐧 create a file descriptor for event notification
memfd_create 🐧 create an anonymous file
memfd_secret 🐧 create an anonymous RAM-based file to access secret memory regions
timerfd_create 🐧 create a timer that notifies via file descriptor
userfaultfd 🐧 create a file descriptor for handling page faults in user space
signalfd4 🐧 create a file descriptor for accepting signals
pidfd_open 🐧 obtain a file descriptor that refers to a process
pidfd_getfd 🐧 obtain a duplicate of another process's file descriptor

Duplicate a file descriptor

Name OS Description
dup 🐑, 🐧, 😈, 🍏 duplicate an existing file descriptor
dup2 🐑, 😈, 🍏 duplicate an existing file descriptor
dup3 🐑, 🐧 duplicate an existing file descriptor

Modify file descriptor metadata

Name OS Description
fcntl 🐑, 🐧, 😈, 🍏 file control
ioctl 🐑, 🐧, 😈, 🍏 device control
lseek 🐑, 🐧, 😈, 🍏 reposition read/write file offset
llseek 🐧 reposition read/write file offset
getdtablecount 🐑 get descriptor table count

Provide file descriptor hints

Name OS Description
fadvise64 🐧 predeclare an access pattern for file data
fadvise64_64 🐧 predeclare an access pattern for file data
readahead 🐧 initiate file readahead into page cache

I/O on a file descriptor

Read
Name OS Description
read 🐑, 🐧, 😈, 🍏 read from a file descriptor
readv 🐑, 🐧, 😈, 🍏 read from a file descriptor
pread 🐑, 😈, 🍏 read from a file descriptor at the specified offset
preadv 🐑, 🐧, 😈, 🍏 read from a file descriptor at the specified offset
preadv2 🐧 read from a file descriptor at the specified offset
Write
Name OS Description
write 🐑, 🐧, 😈, 🍏 write to a file descriptor
writev 🐑, 🐧, 😈, 🍏 write to a file descriptor
pwrite 🐑, 😈, 🍏 write to a file descriptor at the specified offset
pwritev 🐑, 🐧, 😈, 🍏 write to a file descriptor at the specified offset
pwritev2 🐧 write to a file descriptor at the specified offset
Zero-copy
Name OS Description
copy_file_range 🐧, 😈 copy a range of bytes between two file descriptors that refer to files
sendfile 🐧, 😈, 🍏 move data from source (must support mmap-like operations) to a destination file descriptor
tee 🐧 duplicate pipe content
splice 🐧 move data to/from a pipe
vmsplice 🐧 splice user pages to/from a pipe

Close a file descriptor

Name OS Description
close 🐑, 🐧, 😈, 🍏 close a file descriptor
closefrom 🐑 close all file descriptors starting from the specified file descriptor
close_range 🐧, 😈 close all file descriptors in a given range

File system

Create an object

Name OS Description
mkdir 🐑, 😈, 🍏 create a directory file
mkdirat 🐑, 🐧, 😈, 🍏 create a directory file (relative to a directory file descriptor)
mkfifo 🐑, 😈, 🍏 create a FIFO file
mkfifoat 🐑, 😈, 🍏 create a FIFO file (relative to a directory file descriptor)
mknod 🐑, 🍏 create a special file node
mknodat 🐑, 🐧, 😈, 🍏 create a special file node (relative to a directory file descriptor)
link 🐑, 😈, 🍏 create a hard link to file
linkat 🐑, 🐧, 😈, 🍏 create a hard link to file (relative to a directory file descriptor)
symlink 🐑, 😈, 🍏 create a symbolic link to file
symlinkat 🐑, 🐧, 😈, 🍏 create a symbolic link to file (relative to a directory file descriptor)

Modify an object

Name OS Description
rename 🐑, 😈, 🍏 change the name or location of a file
renameat 🐑, 🐧, 😈, 🍏 change the name or location of a file (relative to a directory file descriptor)
renameat2 🐧 change the name or location of a file (relative to a directory file descriptor)
renameatx_np 🍏 change the name or location of a file (relative to a directory file descriptor)
clonefileat 🍏 create a copy-on-write clone of files
fclonefileat 🍏 create a copy-on-write clone of files (referenced by a file descriptor)
truncate 🐑, 🐧, 😈, 🍏 truncate or extend a file to a specified length
ftruncate 🐑, 🐧, 😈, 🍏 truncate or extend a file to a specified length (referenced by a file descriptor)
fallocate 🐧 manipulate file space

Change object permissions

Name OS Description
access 🐑, 😈, 🍏 check access permissions for a file
faccessat 🐑, 🐧, 😈, 🍏 check access permissions for a file (relative to a directory file descriptor)
faccessat2 🐧 check access permissions for a file (relative to a directory file descriptor)
chmod 🐑, 😈, 🍏 change mode of file
fchmod 🐑, 🐧, 😈, 🍏 change mode of file (referenced by a file descriptor)
fchmodat 🐑, 🐧, 😈, 🍏 change mode of file (relative to a directory file descriptor)
fchmodat2 🐧 change mode of file (relative to a directory file descriptor)
chown 🐑, 😈, 🍏 change owner and group of a file
lchown 🐑, 😈, 🍏 change owner and group of a file
fchown 🐑, 🐧, 😈, 🍏 change owner and group of a file (referenced by a file descriptor)
fchownat 🐑, 🐧, 😈, 🍏 change owner and group of a file (relative to a directory file descriptor)
chflags 🐑, 😈, 🍏 set file flags
fchflags 🐑, 😈, 🍏 set file flags (referenced by a file descriptor)
chflagsat 🐑, 😈 set file flags (relative to a directory file descriptor)

Retrieve object stats

Name OS Description
readlink 🐑, 😈, 🍏 read value of a symbolic link
readlinkat 🐑, 🐧, 😈, 🍏 read value of a symbolic link (relative to a directory file descriptor)
stat 🐑, 🐧, 🍏 get file status
lstat 🐑, 🐧, 🍏 get file status
fstat 🐑, 🐧, 😈, 🍏 get file status (referenced by a file handle)
fstatat 🐑, 😈, 🍏 get file status (relative to a directory file descriptor)
statx 🐧 get file status (relative to a directory file descriptor)
fhstat 🐑, 😈 get file status (referenced by a file handle)
statfs 🐑, 🐧, 😈, 🍏 get file system statistics
fstatfs 🐑, 🐧, 😈, 🍏 get file system statistics (referenced by a file descriptor)
fhstatfs 🐑, 😈 get file system statistics (referenced by a file handle)
newfstatat 🐧 get file system statistics (relative to a directory file descriptor)
utimes 🐑, 😈, 🍏 set file access and modification times
lutimes 😈 set file access and modification times
utimensat 🐑, 🐧, 😈 set file access and modification times (relative to a directory file descriptor)
futimes 🐑, 😈, 🍏 set file access and modification times
futimens 🐑, 😈 set file access and modification times
getdents 🐑 get directory entries in a filesystem independent format

Remove object

Name OS Description
unlink 🐑, 😈, 🍏 remove directory entry
unlinkat 🐑, 🐧, 😈, 🍏 remove directory entry (relative to a directory file descriptor)
rmdir 🐑, 😈, 🍏 remove a directory file

Advisory locking

Name OS Description
flock 🐑, 🐧, 😈, 🍏 apply or remove an advisory lock on an open file

Mount points

Name OS Description
mount 🐑, 🐧, 😈, 🍏 mount a filesystem
getfsstat 🐑, 😈, 🍏 get list of all mounted file systems
unmount 🐑, 😈, 🍏 dismount a filesystem
umount2 🐧 dismount a filesystem

Change global file system state

Name OS Description
sync 🐑, 🐧, 😈, 🍏 synchronize disk in-core state with storage device
fsync 🐑, 🐧, 😈, 🍏 synchronize file in-core state with storage device
fdatasync 🐧, 😈, 🍏 synchronize file in-core state with storage device
sync_file_range 🐧 synchronize file's segment with disk
sync_file_range2 🐧 synchronize file's segment with disk
syncfs 🐧 commit filesystem caches to disk

Change object extended attributes

Name OS Description
getxattr 🐧, 🍏 retrieve an extended attribute value
lgetxattr 🐧 retrieve an extended attribute value
fgetxattr 🐧, 🍏 retrieve an extended attribute value (referenced by a file descriptor)
setxattr 🐧, 🍏 set an extended attribute value
lsetxattr 🐧 set an extended attribute value
fsetxattr 🐧, 🍏 set an extended attribute value (referenced by a file descriptor)
listxattr 🐧, 🍏 list extended attribute names
llistxattr 🐧 list extended attribute names
flistxattr 🐧, 🍏 list extended attribute names (referenced by a file descriptor)
removexattr 🐧, 🍏 remove an extended attribute
lremovexattr 🐧 remove an extended attribute
fremovexattr 🐧, 🍏 remove an extended attribute (referenced by a file descriptor)

Watch objects

Name OS Description
inotify_init1 🐧 initialize an inotify(7) instance
inotify_add_watch 🐧 add a watch to an initialized inotify(7) instance
inotify_rm_watch 🐧 remove an existing watch from an inotify(7) instance
fanotify_init 🐧 create and initialize fanotify(7) group
fanotify_mark 🐧 add, remove, or modify an fanotify(7) mark on a filesystem object

Retrieve filesystem variables

Name OS Description
pathconf 🐑, 😈, 🍏 get configurable pathname variables
fpathconf 🐑, 😈, 🍏 get configurable pathname variables (referenced by a file descriptor)

Network

Berkeley sockets

Create
Name OS Description
socket 🐑, 🐧, 😈, 🍏 create an endpoint for communication
socketpair 🐑, 🐧, 😈, 🍏 create a pair of connected sockets
Socket lifecycle
Name OS Description
connect 🐑, 🐧, 😈, 🍏 initiate a connection on a socket
bind 🐑, 🐧, 😈, 🍏 bind a name to a socket
listen 🐑, 🐧, 😈, 🍏 listen for connections on a socket
accept 🐑, 🐧, 😈, 🍏 accept a connection on a socket
accept4 🐑, 🐧, 😈 accept a connection on a socket
Socket metadata
Name OS Description
getsockname 🐑, 🐧, 😈, 🍏 get local protocol address associated with a socket
getpeername 🐑, 🐧, 😈, 🍏 get remote protocol address associated with a socket
getsockopt 🐑, 🐧, 😈, 🍏 get socket options
setsockopt 🐑, 🐧, 😈, 🍏 set socket options
I/O on a socket
Name OS Description
recvfrom 🐑, 🐧, 😈, 🍏 receive a message from a socket
recvmsg 🐑, 🐧, 😈, 🍏 receive a message from a socket
recvmmsg 🐑, 🐧 receive a message from a socket
sendto 🐑, 🐧, 😈, 🍏 send a message on a socket
sendmsg 🐑, 🐧, 😈, 🍏 send a message on a socket
sendmmsg 🐑, 🐧 send a message on a socket
shutdown 🐑, 🐧, 😈, 🍏 disable sends or receives on a socket

NFS

Name OS Description
nfssvc 🐑, 😈, 🍏 NFS daemon services
nfsservctl 🐧 NFS daemon services

Polling, multiplexing and asynchronous I/O

Polling and multiplexing

Name OS Description
select 🐑, 😈, 🍏 synchronous I/O multiplexing
pselect 🐑, 😈, 🍏 synchronous I/O multiplexing
pselect6 🐧 synchronous I/O multiplexing
poll 🐑, 😈, 🍏 synchronous I/O multiplexing
ppoll 🐑, 🐧, 😈 synchronous I/O multiplexing
kqueue 🐑, 😈, 🍏 create a new kernel event queue
kqueue1 🐑 create a new kernel event queue
kevent 🐑, 😈, 🍏 register events with the kernel event queue
epoll_create1 🐧 open an epoll(7) file descriptor
epoll_ctl 🐧 control interface for an epoll(7) file descriptor
epoll_pwait 🐧 wait for an I/O event on an epoll(7) file descriptor
epoll_pwait2 🐧 wait for an I/O event on an epoll(7) file descriptor

POSIX asynchronous I/O

Name OS Description
aio_read 😈, 🍏 asynchronous read from a file
aio_write 😈, 🍏 asynchronous write to a file
aio_fsync 😈, 🍏 asynchronous fsync
aio_mlock 😈 asynchronous mlock
aio_return 😈, 🍏 retrieve return status of an asynchronous I/O operation
aio_error 😈, 🍏 retrieve error status of asynchronous I/O operation
aio_suspend 😈, 🍏 suspend until asynchronous I/O operations complete or time out
aio_waitcomplete 😈 wait for the next completion of an asynchronous I/O operation
aio_cancel 😈, 🍏 cancel an outstanding asynchronous I/O operation

Asynchronous I/O (Linux)

Name OS Description
io_setup 🐧 create an asynchronous I/O context
io_submit 🐧 submit asynchronous I/O blocks for processing
io_getevents 🐧 read asynchronous I/O events from the completion queue
io_pgetevents 🐧 read asynchronous I/O events from the completion queue
io_cancel 🐧 cancel an outstanding asynchronous I/O operation
io_destroy 🐧 destroy an asynchronous I/O context

io_uring (Linux)

Name OS Description
io_uring_setup 🐧 setup a context for performing asynchronous I/O
io_uring_register 🐧 register files or user buffers for asynchronous I/O
io_uring_enter 🐧 initiate and/or complete asynchronous I/O

Security

Sandboxing

Name OS Description
seccomp 🐧 operate on Secure Computing state of the process
revoke 🐑, 😈, 🍏 revoke file access
pledge 🐑 force the current process into a restricted-service operating mode
unveil 🐑 unveil parts of a restricted filesystem view
msyscall 🐑 permit system calls from a region of pages

Jails (FreeBSD)

See Jails and Containers chapter in the FreeBSD Handbook for more details.

Name OS Description
jail 😈 sets up a jail and locks the current process in it
jail_attach 😈 attaches the current process to an existing jail
jail_get 😈 retrieves jail parameters
jail_set 😈 creates a new jail or modifies an existing one
jail_remove 😈 removes the jail

Capabilities (Linux)

See capabilities(7) man page for more details.

Name OS Description
capget 🐧 get capabilities of thread(s)
capset 🐧 set capabilities of thread(s)

Namespaces (Linux)

See namespaces(7) man page for more details.

Name OS Description
setns 🐧 reassociate thread with a namespace
unshare 🐧 disassociate parts of the process execution context

Landlock (Linux)

See landlock(7) man page for more details.

Name OS Description
landlock_create_ruleset 🐧 create a new Landlock ruleset
landlock_add_rule 🐧 add a new Landlock rule to a ruleset
landlock_restrict_self 🐧 enforce a Landlock ruleset

Entropy and random

Name OS Description
getentropy 🐑, 🍏 get high-quality entropy
getrandom 🐧, 😈 get high-quality entropy

Kernel Key Retention Service

See Kernel Key Retention Service documentation for more details.

Name OS Description
add_key 🐧 add a key to the kernel's key management facility
request_key 🐧 request a key from the kernel's key management facility
keyctl 🐧 manipulate the kernel's key management facility

Interprocess communication

System V semaphores

Name OS Description
semget 🐑, 🐧, 😈, 🍏 retrieve semaphore set
semop 🐑, 🐧, 😈, 🍏 atomic operations on a set of semaphores
semtimedop 🐧 atomic operations on a set of semaphores (with timeout)
semctl 🐧, 🍏 control operations on a set of semaphores
__semctl 🐑, 😈 control operations on a set of semaphores

POSIX message queues

Name OS Description
msgget 🐑, 🐧, 😈, 🍏 retrieve message queue
msgrcv 🐑, 🐧, 😈, 🍏 receive a message from a message queue
msgsnd 🐑, 🐧, 😈, 🍏 send a message to a message queue
msgctl 🐑, 🐧, 😈, 🍏 control operations on a message queue
mq_open 🐧 open a message queue
mq_timedreceive 🐧 receive a message from a message queue
mq_timedsend 🐧 send a message to a message queue
mq_notify 🐧 register for notification when a message is available
mq_getsetattr 🐧 get/set message queue attributes
mq_unlink 🐧 remove a message queue

Shared memory

Name OS Description
shmat 🐑, 🐧, 😈, 🍏 map shared memory area
shmget 🐑, 🐧, 😈, 🍏 get shared memory area identifier
shmctl 🐑, 🐧, 😈, 🍏 shared memory area control operations
shmdt 🐑, 🐧, 😈, 🍏 unmap shared memory area

System

General

Name OS Description
reboot 🐑, 🐧, 😈, 🍏 reboot system or halt processor
sysctl 🐑, 🍏 manipulate system information
sysinfo 🐧 return system information
uname 🐧 get name and information about current kernel
sethostname 🐧 manipulate hostname
setdomainname 🐧 manipulate NIS domain name

Kernel

Kernel module management (Linux)
Name OS Description
init_module 🐧 load a kernel module
finit_module 🐧 load a kernel module (referenced by a file descriptor)
delete_module 🐧 unload a kernel module
kexec (Linux)
Name OS Description
kexec_load 🐧 load a new kernel for later execution
kexec_file_load 🐧 load a new kernel for later execution (referenced by a file descriptor)
Dynamic kernel linker facility (FreeBSD)

See kld(4) man page for more details

Name OS Description
kldload 😈 load KLD file into the kernel
kldunload 😈 unload KLD fileid from the kernel
kldunloadf 😈 unload KLD fileid from the kernel
kldsym 😈 look up address by symbol name in a KLD file
kldfind 😈 return the fileid of a KLD file
kldnext 😈 return the fileid of the next KLD file
kldstat 😈 get status of a KLD file
kldfirstmod 😈 return first module ID from the KLD file

System log

Name OS Description
syslog 🐧 read and/or clear kernel message ring buffer
sendsyslog 🐑 send a message to syslogd(8) daemon
utrace 🐑, 😈 insert user record in ktrace(2) log

Swap

Name OS Description
swapctl 🐑 modify swap configuration
swapon 🐧, 😈, 🍏 start swapping to a file/device
swapoff 🐧, 😈 stop swapping from a file/device

Clock and time functions

Name OS Description
gettimeofday 🐑, 🐧, 😈, 🍏 get the time of day
settimeofday 🐑, 🐧, 😈, 🍏 set the time of day
clock_gettime 🐑, 🐧, 😈 get the time of a given clock
clock_settime 🐑, 🐧, 😈 set the time for a given clock
clock_getres 🐑, 🐧, 😈 get the resolution of a given clock
clock_adjtime 🐧 tune a given clock
adjtime 🐑, 😈, 🍏 tune the system clock
adjtimex 🐧 tune the system clock
adjfreq 🐑 correct the rate of the system clock

Quotas and accounting

Name OS Description
acct 🐑, 🐧, 😈, 🍏 enable or disable process accounting
quotactl 🐑, 🐧, 😈, 🍏 manipulate filesystem quotas

Performance, profiling and and eBPF

Name OS Description
bpf 🐧 manipulate extended Berkeley Packet Filters
perf_event_open 🐧 set up performance monitoring
profil 🐑, 😈 manipulate program counter profiling of the current process

Meta system calls

Name OS Description
syscall 😈, 🍏 indirect system call
__syscall 😈 indirect system call
sysarch 🐑, 😈 architecture-dependent system call
arch_specific_syscall 🐧 architecture-dependent system call
restart_syscall 🐧 restart a system call after interruption by a stop signal