System calls and kernel mode

In short: Programs run in restricted user mode and may not touch hardware directly. For files, network or memory they ask the kernel for help via system calls.

In more detail: The CPU has privilege levels. The kernel runs in privileged mode. A system call such as read triggers a controlled switch into the kernel (trap); the kernel checks rights, performs the task and returns. This protects the system from faulty or malicious programs.

In Depth

• Examples: open, read, write, fork, exec, mmap, socket.
• Cost: A switch costs a few hundred nanoseconds. Many small calls slow things down (hence buffered I/O).
• Libraries: The C function printf calls write internally.
• strace: Shows all system calls of a process, valuable for debugging.
• Interrupts: Hardware interrupts the CPU; drivers handle them in the kernel.
• Microkernel vs. monolithic: Linux is monolithic, others move drivers into user processes.
• Sandboxing: seccomp restricts permitted system calls.

See also: Process scheduling, Container internals: namespaces and cgroups