A Go Programmer ' s Guide to Syscalls, Liz Rice

This is a creation in Article, where the information may have evolved or changed.

Overview

Even if you ' ve never used Go's syscall package-in fact even if you've only ever written "Hello, World"-We have Defini Tely used Syscalls. They provide the interface between your code and the operating system.

Liz goes under the hood to explore what syscalls is, how they work, and how some common Go code makes of use of them. She covers what people mean when they talk about strace ptrace and, and looks on what Syscalls has to do with privileges an D permissions. She does all the through a live demo by writing strace from scratch.

What is Syscalls?

Your application requests services from the kernel. Your user-space code really can ' t do very much by itself. Every time it wants to access things like hardware it needs to access the kernel. You need syscalls to access processes, files, devices, communications, and time & date.

Even though you don't really think about these syscalls and you'll need the help that syscalls give you from the kernel.

"In computing, a system call is the programmatic-a-which a computer program requests a service from the kernel of the Operating system it is executed on. This could include hardware-related services (for example, accessing a hard disk drive), creation and execution of new PROCE SSEs, and communication with the integral kernel services such as process scheduling. System calls provide an essential interface between a process and the operating system. "

What happens when making a syscall?

• Set registers up with Syscall ID and parameters
• Trap-transition to Kernel-run syscall code
• Result returned in%rax (x86)

We have hardware specific versions in the Syscall package so it can write the parameters into the correct registers. Syscalls is extremely portable. Syscalls is allows Linux to run on different hardware through a emulation layer.

It is not necessary to implement all the possible syscall functions and most commonly only a subset would be implemented. When Microsoft implemented the bash emulation they had a implementation for about $ syscalls. Perhaps of used that often.

Syscall Profiling

straceis built on to allow ptrace a user to trace all system calls made by another process. To view a summary of the system calls use: strace -c .

Example

Using Liz ' s Live coding example strace from scratch and strace -c we can identify which syscalls were.

It is a helpful to review the Linux Mans page to better understand and ptrace Liz's implementation of strace .

From Ptrace to Mans page

• A Tracee first needs to being attached to the tracer
• Attachment and subsequent commands is per thread
• Ptrace commands is always sent-a specific tracee using a call of the form

ptrace(PTRACE_food, pid, …)

Where is the pid thread ID of the corresponding Linux thread.

Stops for Ptrace_syscall

• The Tracee enters Syscall-enter-stop just prior to entering any system call. The trace enters syscall-exit-stop when the system call is finished. These calls is indistinguishable from all other by the tracer.
• The tracer needs to keep track of the sequence of Ptrace-stops
  • This is very important otherwise you'll see duplicate messages. You can verify the removing the exit check in the example code.

Syscalls and security

Security Profiles and Containers

It is possible to use for syscalls nefarious purposes which makes following the least privilege principle important. Least privilege is the concept and practice of restricting access rights for users, accounts, and computing processes to O Nly those that is essential to perform its intended purpose. We can add security with the seccomp restricting which syscalls this process can call.

Syscalls Recap

• Even if you ' re not using syscalls directly they is your interface into the kernel.
• They is portable and allow for running Linux on different hardware
• Limiting syscalls by following least privilege adds a layer of security

About the Speaker

Liz Rice was the technical evangelist at container security specialists Aqua security. Prior to that she is CEO of microscaling Systems and one of the developers of Microbadger, the tool for managing Containe R metadata. She has a wealth of software development, team, and product management experience from working on network protocols and DI Stributed systems, and in digital technology sectors such as VOD, music, and VoIP. When isn't building startups and writing code, Liz loves riding bikes in places with better weather than her native London.

@lizrice