Syscalls Cheatsheet

System calls are the interface between user-space applications and the Linux kernel. This cheatsheet lists common syscalls grouped by category. Refer to man 2 <syscall_name> for detailed information. Wrapper functions are typically provided by glibc.

File System Operations

Syscall (man 2)	glibc Wrapper(s)	Description
`open`	`open()`, `creat()`	Open or create a file or device. Returns a file descriptor (fd).
`openat`	`openat()`	Open/create a file relative to a directory file descriptor.
`close`	`close()`	Close a file descriptor.
`read`	`read()`	Read data from a file descriptor into a buffer.
`write`	`write()`	Write data from a buffer to a file descriptor.
`pread64`	`pread()`	Read from a file descriptor at a given offset (atomic).
`pwrite64`	`pwrite()`	Write to a file descriptor at a given offset (atomic).
`lseek`	`lseek()`	Reposition the read/write offset of a file descriptor.
`stat`	`stat()`	Get file status information (metadata) by path.
`fstat`	`fstat()`	Get file status information by file descriptor.
`lstat`	`lstat()`	Get file status, but if it's a symbolic link, get link info instead.
`access`	`access()`	Check user's permissions for a file based on real UID/GID.
`faccessat`	`faccessat()`	Check permissions relative to a directory fd.
`chmod`	`chmod()`	Change file permissions (mode).
`fchmod`	`fchmod()`	Change permissions of file referred to by fd.
`fchmodat`	`fchmodat()`	Change permissions relative to a directory fd.
`chown`	`chown()`	Change file owner and group.
`fchown`	`fchown()`	Change owner/group of file referred to by fd.
`lchown`	`lchown()`	Change owner/group of a symbolic link itself.
`fchownat`	`fchownat()`	Change owner/group relative to a directory fd.
`link`	`link()`	Create a new hard link to an existing file.
`linkat`	`linkat()`	Create a hard link relative to directory fds.
`unlink`	`unlink()`	Delete a name (link) from the filesystem. If last link, file is deleted.
`unlinkat`	`unlinkat()`	Delete a name relative to a directory fd.
`symlink`	`symlink()`	Create a symbolic link.
`symlinkat`	`symlinkat()`	Create a symbolic link relative to a directory fd.
`readlink`	`readlink()`	Read the value (target path) of a symbolic link.
`readlinkat`	`readlinkat()`	Read value of a symlink relative to a directory fd.
`mkdir`	`mkdir()`	Create a directory.
`mkdirat`	`mkdirat()`	Create a directory relative to a directory fd.
`rmdir`	`rmdir()`	Delete an empty directory.
`rename`	`rename()`	Rename or move a file or directory.
`renameat`	`renameat()` / `renameat2()`	Rename/move relative to directory fds (with flags).
`mknod`	`mknod()`	Create a special or ordinary file (device files, FIFOs).
`mknodat`	`mknodat()`	Create a special file relative to a directory fd.
`mount`	`mount()`	Mount a filesystem.
`umount2`	`umount()`, `umount2()`	Unmount a filesystem (with flags).
`statfs`	`statfs()`	Get filesystem statistics by path.
`fstatfs`	`fstatfs()`	Get filesystem statistics by file descriptor.
`fcntl`	`fcntl()`	Manipulate file descriptors (duplicate, get/set flags, file locks).
`ioctl`	`ioctl()`	Control device parameters (device-specific operations).
`flock`	`flock()`	Apply or remove an advisory lock on an open file.
`fsync`	`fsync()`	Synchronize a file's in-core state with storage device (data+metadata).
`fdatasync`	`fdatasync()`	Synchronize file data with storage device (metadata optional).
`sync`	`sync()`	Commit filesystem caches to disk (all filesystems).
`truncate`	`truncate()`	Truncate a file to a specified length.
`ftruncate`	`ftruncate()`	Truncate file referred to by fd to a specified length.
`getdents64`	`readdir()` (via glibc)	Read directory entries.
`utime`	`utime()`	Change file last access and modification times (older).
`utimes`	`utimes()`	Change file access/modification times with microsecond precision.
`utimensat`	`utimensat()`	Change timestamps relative to directory fd / with nanosecond precision.
`futimesat`	`futimesat()`	Deprecated equivalent of `utimensat`.
`chdir`	`chdir()`	Change current working directory.
`fchdir`	`fchdir()`	Change working directory using a file descriptor.
`getcwd`	`getcwd()`	Get current working directory path.

Process Management

Syscall (man 2)	glibc Wrapper(s)	Description
`fork`	`fork()`	Create a new process by duplicating the calling process (child process).
`vfork`	`vfork()`	Create child process and block parent (use with caution, often replaced by fork/clone).
`clone`	`clone()`	Create a child process with fine-grained control over resource sharing (threads).
`execve`	`execve()`	Execute a new program, replacing the current process image.
`exit`	`_exit()`, `_Exit()`	Terminate the current process immediately (without `stdio` flushing).
`exit_group`	`exit()` (via glibc)	Terminate all threads in the current thread group.
`wait4`	`wait()`, `waitpid()`, `wait3()`, `wait4()`	Wait for process state changes in children.
`waitid`	`waitid()`	Wait for process state changes (more flexible/precise than `waitpid`).
`kill`	`kill()`	Send a signal to a process or process group.
`tkill`		Send a signal to a specific thread (older).
`tgkill`	`tgkill()`	Send a signal to a specific thread within a specific thread group.
`getpid`	`getpid()`	Get the process ID (PID) of the calling process.
`getppid`	`getppid()`	Get the parent process ID (PPID) of the calling process.
`getuid`	`getuid()`	Get the real user ID (UID) of the calling process.
`geteuid`	`geteuid()`	Get the effective user ID (EUID) of the calling process.
`getgid`	`getgid()`	Get the real group ID (GID) of the calling process.
`getegid`	`getegid()`	Get the effective group ID (EGID) of the calling process.
`getresuid`	`getresuid()`	Get real, effective, and saved set-user-IDs.
`getresgid`	`getresgid()`	Get real, effective, and saved set-group-IDs.
`setuid`	`setuid()`	Set the effective user ID (EUID) of the calling process.
`setgid`	`setgid()`	Set the effective group ID (EGID) of the calling process.
`setreuid`	`setreuid()`	Set real and effective user IDs.
`setregid`	`setregid()`	Set real and effective group IDs.
`setresuid`	`setresuid()`	Set real, effective, and saved set-user-IDs.
`setresgid`	`setresgid()`	Set real, effective, and saved set-group-IDs.
`getgroups`	`getgroups()`	Get list of supplementary group IDs.
`setgroups`	`setgroups()`	Set list of supplementary group IDs.
`setpgid`	`setpgid()`	Set process group ID for job control.
`getpgid`	`getpgid()`	Get process group ID.
`setsid`	`setsid()`	Creates a new session and sets the process group ID (become session leader).
`getsid`	`getsid()`	Get session ID.
`getpriority`	`getpriority()`	Get program scheduling priority.
`setpriority`	`setpriority()`	Set program scheduling priority.
`prctl`	`prctl()`	Process control operations (set name, capabilities, security features, etc.).
`capget`	`capget()`	Get process capabilities.
`capset`	`capset()`	Set process capabilities.
`sched_yield`	`sched_yield()`	Yield the processor to other threads/processes.
`sched_setscheduler`	`sched_setscheduler()`	Set scheduling policy and parameters for a process.
`sched_getscheduler`	`sched_getscheduler()`	Get scheduling policy for a process.
`sched_setaffinity`	`sched_setaffinity()`	Set CPU affinity mask for a process/thread.
`sched_getaffinity`	`sched_getaffinity()`	Get CPU affinity mask for a process/thread.
`gettid`	`gettid()`	Get the thread ID (TID) of the calling thread.
`unshare`	`unshare()`	Disassociate parts of the process execution context (namespaces).
`setns`	`setns()`	Reassociate thread with a namespace.

Memory Management

Syscall (man 2)	glibc Wrapper(s)	Description
`brk`	`brk()`, `sbrk()`	Change data segment size (program break). Low-level, often managed by `malloc`.
`mmap`	`mmap()`	Map files or devices into memory / allocate anonymous memory.
`munmap`	`munmap()`	Unmap files or devices from memory.
`mprotect`	`mprotect()`	Set protection (read/write/exec) on a region of memory.
`msync`	`msync()`	Synchronize a file mapped in memory with the storage device.
`madvise`	`madvise()`	Give advice about memory usage patterns to the kernel.
`mlock`	`mlock()`	Lock a region of memory, preventing it from being paged out.
`munlock`	`munlock()`	Unlock a region of memory.
`mlockall`	`mlockall()`	Lock all pages mapped by the process.
`munlockall`	`munlockall()`	Unlock all pages mapped by the process.
`mincore`	`mincore()`	Determine whether pages are resident in memory.
`shmget`	`shmget()`	Allocates a System V shared memory segment.
`shmat`	`shmat()`	Attaches the System V shared memory segment to the address space.
`shmdt`	`shmdt()`	Detaches the System V shared memory segment.
`shmctl`	`shmctl()`	System V shared memory control operations (get status, set permissions, remove).

Inter-Process Communication (IPC)

Syscall (man 2)	glibc Wrapper(s)	Description
`pipe`	`pipe()`	Create a unidirectional data channel (pipe).
`pipe2`	`pipe2()`	Create a pipe with additional flags (e.g., `O_NONBLOCK`).
`dup`	`dup()`	Duplicate an existing file descriptor.
`dup2`	`dup2()`	Duplicate fd, specifying the new descriptor number.
`dup3`	`dup3()`	Duplicate fd with flags.
`socket`	`socket()`	Create an endpoint for communication (network or Unix domain).
`bind`	`bind()`	Bind a name (address/port) to a socket.
`listen`	`listen()`	Listen for connections on a socket.
`accept`	`accept()`, `accept4()`	Accept a connection on a socket (returns new connected socket fd).
`connect`	`connect()`	Initiate a connection on a socket.
`socketpair`	`socketpair()`	Create a pair of connected sockets (useful for IPC).
`sendto`	`sendto()`	Send a message on a socket (connectionless or connected).
`recvfrom`	`recvfrom()`	Receive a message from a socket.
`sendmsg`	`sendmsg()`	Send a message with ancillary data (e.g., file descriptors) on a socket.
`recvmsg`	`recvmsg()`	Receive a message with ancillary data from a socket.
`shutdown`	`shutdown()`	Shut down part of a full-duplex connection.
`getsockopt`	`getsockopt()`	Get socket options.
`setsockopt`	`setsockopt()`	Set socket options.
`msgget`	`msgget()`	Get a System V message queue identifier.
`msgsnd`	`msgsnd()`	Send a message to a System V message queue.
`msgrcv`	`msgrcv()`	Receive a message from a System V message queue.
`msgctl`	`msgctl()`	System V message queue control operations.
`semget`	`semget()`	Get a System V semaphore set identifier.
`semop`	`semop()`	Perform System V semaphore operations (wait, post).
`semctl`	`semctl()`	System V semaphore control operations.
`shmget`, `shmat`, `shmdt`, `shmctl`	(See Memory Mgmt)	System V Shared Memory operations.
`mq_open`	`mq_open()`	Open or create a POSIX message queue.
`mq_send`	`mq_send()`	Send a message to a POSIX message queue.
`mq_receive`	`mq_receive()`	Receive a message from a POSIX message queue.
`mq_close`	`mq_close()`	Close a POSIX message queue descriptor.
`mq_unlink`	`mq_unlink()`	Remove a POSIX message queue name.
`mq_notify`	`mq_notify()`	Register for notification when a message arrives on an empty queue.
`mq_getsetattr`	`mq_getsetattr()`	Get/set POSIX message queue attributes.

Signal Handling

Syscall (man 2)	glibc Wrapper(s)	Description
`kill`	`kill()`	Send a signal to a process or process group.
`tgkill`	`tgkill()`	Send a signal to a specific thread within a specific thread group (TID/TGID).
`sigaction`	`sigaction()`	Examine and change signal action (preferred way to set handlers).
`signal`	`signal()`	ANSI C signal handling (less portable/reliable than `sigaction`).
`sigprocmask`	`sigprocmask()`	Examine and change blocked signals for the calling thread.
`sigsuspend`	`sigsuspend()`	Atomically replace signal mask and suspend process until signal arrives.
`sigpending`	`sigpending()`	Examine pending signals that are blocked.
`pause`	`pause()`	Wait for any signal to be caught.
`alarm`	`alarm()`	Set a timer to deliver a `SIGALRM` signal.
`rt_sigaction`	(Internal; see `sigaction`)	Real-time signal version of `sigaction`.
`rt_sigprocmask`	(Internal; see `sigprocmask`)	Real-time signal version of `sigprocmask`.
`rt_sigpending`	(Internal; see `sigpending`)	Real-time signal version of `sigpending`.
`rt_sigsuspend`	(Internal; see `sigsuspend`)	Real-time signal version of `sigsuspend`.
`rt_sigqueueinfo`	`sigqueue()`	Queue a real-time signal and data to a process.
`rt_sigtimedwait`	`sigtimedwait()`	Synchronously wait for queued signals with a timeout.
`signalfd`	`signalfd()`	Create a file descriptor to accept signals synchronously.

Time and Timers

Syscall (man 2)	glibc Wrapper(s)	Description
`time`	`time()`	Get time in seconds since the Epoch.
`gettimeofday`	`gettimeofday()`	Get time with microsecond resolution (largely superseded by `clock_gettime`).
`clock_gettime`	`clock_gettime()`	Get time of specified clock (monotonic, real-time) with nanosecond resolution.
`clock_settime`	`clock_settime()`	Set time of specified clock.
`clock_getres`	`clock_getres()`	Get resolution (precision) of specified clock.
`nanosleep`	`nanosleep()`	Pause execution for specified interval with nanosecond precision.
`clock_nanosleep`	`clock_nanosleep()`	High-resolution sleep with specified clock and flags.
`alarm`	`alarm()`	Schedule `SIGALRM` signal after specified number of seconds.
`setitimer`	`setitimer()`	Set value of interval timer (`ITIMER_REAL`, `ITIMER_VIRTUAL`, `ITIMER_PROF`).
`getitimer`	`getitimer()`	Get value of interval timer.
`timer_create`	`timer_create()`	Create a POSIX per-process timer.
`timer_settime`	`timer_settime()`	Arm or disarm a POSIX timer.
`timer_gettime`	`timer_gettime()`	Fetch state of a POSIX timer.
`timer_getoverrun`	`timer_getoverrun()`	Get expiration overrun count for a POSIX timer.
`timer_delete`	`timer_delete()`	Delete a POSIX timer.
`timerfd_create`	`timerfd_create()`	Create a file descriptor that acts as an interval timer.
`timerfd_settime`	`timerfd_settime()`	Arm or disarm a timerfd file descriptor.
`timerfd_gettime`	`timerfd_gettime()`	Get current setting of a timerfd file descriptor.
`adjtimex`	`adjtimex()`	Tune kernel clock parameters (NTP related).

System Information and Control

Syscall (man 2)	glibc Wrapper(s)	Description
`uname`	`uname()`	Get system name, node name, release, version, machine information.
`sysinfo`	`sysinfo()`	Returns overall system statistics (memory, uptime, load, etc.).
`getrlimit`	`getrlimit()`	Get resource limits (e.g., max open files, max CPU time).
`setrlimit`	`setrlimit()`	Set resource limits.
`getrusage`	`getrusage()`	Get resource usage (CPU time, memory usage) for process or children.
`reboot`	`reboot()`	Reboot or enable/disable Ctrl-Alt-Delete.
`syslog`	`syslog()` (via glibc)	Read or clear kernel message ring buffer; control logging level. (`dmesg` uses this).
`ptrace`	`ptrace()`	Process trace - used by debuggers and tracing tools.
`sethostname`	`sethostname()`	Set the system hostname.
`setdomainname`	`setdomainname()`	Set the system domain name.
`personality`	`personality()`	Set the process execution domain (influences syscall behavior for compatibility).
`acct`	`acct()`	Turn process accounting on or off.
`getrandom`	`getrandom()`	Obtain cryptographically secure random bytes.
`getcpu`	`getcpu()`	Determine CPU and NUMA node on which the calling thread is running.

Note: This list is not exhaustive. Linux has hundreds of system calls, many specialized or internal. Always consult the man 2 pages for authoritative details. Syscall numbers can vary between architectures (x86_64, aarch64, etc.).