Four Ways to Talk to the Kernel

Four Ways to Talk to the Kernel

Thesis

User space reaches the kernel through a few stable doors: syscalls, /proc & /sys, netlink, and ioctl/eBPF.

Mental model

  syscall | proc/sys | netlink | ioctl/eBPF

Worked examples

python3 -c 'import os; print(os.getpid())'
cat /proc/sys/net/ipv4/tcp_fastopen
cat /sys/block/vda/queue/scheduler

ip/ss speak netlink; eBPF is for programmable hooks when the other doors are not enough.

Trap

Parsing ps instead of /proc. Columns change; /proc/<pid>/status is stabler.

Boring rule

Prefer syscalls and documented proc/sys. Escalate carefully.

Try this

1. man 7 netlink, man 2 bpf.
2. Compare sysctl vs /proc/sys writes on a machine you own.
3. Trace ss with strace where available.

Sources

• syscalls(2), proc(5), netlink(7), bpf(2)