Learn

Linux System Calls

Watch real programs talk to the kernel. Learn syscalls by tracing, not by guessing.

Every program on Linux, from ls to a database, gets everything it cannot do itself by asking the kernel, and every ask is a system call. This track teaches you to see those asks. Using strace on a real virtual machine you trace programs you already use, read the exact calls they make, watch a process spawn and a pipeline get wired together, and diagnose a program that will not start. No C required to begin. By the end you can open a trace of anything on a Linux box and read what it is really doing, which is the substrate under every hard troubleshooting problem.

8 hands-on labs across 3 modules, about 4 hours of work. Every lab runs on a real virtual machine in your browser, and checks your work on the machine itself.

Modules and labs

The Boundary

What a system call is, and how to watch one happen. Trace real programs you already use and see the exact requests they make to the kernel, before you write a line of code.

• Your First System Call - Run strace on a program you already know and watch it talk to the kernel.
• Files Through the Syscall Lens - Trace how a program opens, reads, writes, and closes a file, and learn the three file descriptors every program is born with.
• When System Calls Fail - Read the errno on a failed syscall, find the one call that broke a program, and repair the environment until the trace comes back clean.

Processes and Plumbing

Watch a program become another program, and watch a shell wire two programs together. fork and exec and wait, then pipes and dup2, all seen in a live trace.

• Watching a Process Spawn - Follow a program as it becomes a second program: clone, execve, wait, and the reason fork shows up in a trace as clone.
• Pipes and Redirection Under the Hood - Trace a shell building a pipeline and a redirect, and watch pipe and dup2 wire one program's output into another's input.

Diagnosis and the Modern Kernel

Use tracing to answer real questions: what is this process stuck on, why will this program not start, and why do some calls never show up. Ends with a forensics capstone on a mystery binary.

• Attach and Diagnose - Attach strace to a program that is already running, read what a hung process is blocked on, and use the summary to find where the time goes.
• The Invisible System Calls - Find out why some calls never appear in strace, the difference between the call you write and the call the kernel sees, and the tool that shows the hidden ones.
• Syscall Forensics - A mystery program will not run. Using only tracing, find what it looks for, where it fails, and fix the box until it succeeds.

Frequently asked questions

How many labs are in Linux System Calls?

Linux System Calls has 8 hands-on labs, roughly 4 hours of guided work, spread across 3 modules.

Do I need my own server or hardware to do the Linux System Calls labs?

No. Every lab boots a real virtual machine in your browser, with a real Linux shell. There is nothing to install, and nothing on your own machine to break.

What level is Linux System Calls?

Labs in this track are rated beginner, intermediate. The track starts from the beginning, so no prior experience is assumed.