System Calls Fundamentals Questions

Core OS-level concepts covering system call interfaces and conventions, examples such as fork, exec, opendir, and stat, kernel-user space interactions, process lifecycle, file I/O, memory management primitives, and basic concurrency primitives in systems programming.

MediumTechnical

61 practiced

Explain copy-on-write in the context of `fork()`. Why is it efficient for process creation, and how can copy-on-write behavior affect memory-sensitive security software that keeps secrets or large buffers in memory?

Sample Answer

**Copy-on-write (COW)** lets `fork()` create a child cheaply by sharing the parent’s pages initially.

text

parent pages -> shared read-only after fork
write in parent/child -> kernel copies only the touched page

**Why it’s efficient:**- No full memory copy at process creation time.- Most children immediately `exec()`, so the shared pages are never duplicated.- It reduces latency and memory pressure for process spawning.

**Security impact:**- If a process holds secrets in memory, a `fork()` temporarily exposes those pages to both parent and child.- Any write after fork can trigger page copies, which may increase RSS and create measurable side effects.- Large buffers can cause memory spikes if the child or parent modifies them.

**Practical concern for security software:**If a daemon keeps encryption keys or tokens in memory, I’d minimize the window between `fork()` and `exec()`, or use `posix_spawn()` when possible. I’d also isolate secrets in locked, scrubbed memory and explicitly clear them before fork if the child does not need them.

So COW is great for performance, but in sensitive software it changes the threat model: forked children inherit access to the parent’s address space until those pages diverge or are scrubbed.

HardTechnical

52 practiced

You need to reduce the blast radius of a compromised helper process. What system-level techniques would you combine around `fork()`/`exec()` to drop privileges, restrict filesystem access, and prevent privilege regain?

MediumTechnical

56 practiced

A helper process exits with an unexpected status code, and your daemon must decide whether to restart it, log it, or quarantine the host. How would you interpret exit codes, signals, and core-dump indicators in `waitpid()` results?

HardTechnical

55 practiced

How can `mprotect()`, `mlock()`, and page permissions be used to reduce the exposure of secrets in memory? What are the limitations of these primitives, especially after a `fork()` or during a crash?

EasyTechnical

67 practiced

In a Unix/Linux system, what is the difference between a system call and a regular library function? Explain how a user-space process crosses into the kernel, what role `errno` plays, and why this distinction matters when writing security-sensitive tooling.

Unlock Full Question Bank

Get access to hundreds of System Calls Fundamentals interview questions and detailed answers.

Join thousands of developers preparing for their dream job.