PR_SET_SYSCALL_USER_DISPATCH(2const)

💖 PR_SET_SYSCALL_USER_DISPATCH 💖

okay bestie, so this whole thing is a (2const) page from the Linux man pages, which basically means it's one of those fun little constant-flavored pages that got carved out of prctl(2). It's the ✨ protocol ✨ for telling your thread "hey, some of my syscalls should come back to me, not the kernel." iykyk.

---

🌸 NAME 🌸

PR_SET_SYSCALL_USER_DISPATCH — sets up the system-call user dispatch mechanism for the calling thread 💅

---

📚 LIBRARY 📚

Standard C library — libc, -lc. yep, the regular one 🫶

---

✨ SYNOPSIS ✨

#include <linux/prctl.h>  /* Definition of PR_* constants */
#include <sys/prctl.h>

int prctl(PR_SET_SYSCALL_USER_DISPATCH, long op, ...);

int prctl(PR_SET_SYSCALL_USER_DISPATCH, PR_SYS_DISPATCH_ON,
          unsigned long off, unsigned long size, int8_t *switch);
int prctl(PR_SET_SYSCALL_USER_DISPATCH, PR_SYS_DISPATCH_OFF, 0L, 0L, 0L);

---

🦋 DESCRIPTION 🦋

So this configures the Syscall User Dispatch mechanism for the calling thread. In human terms: it lets your application selectively intercept system calls so you can handle them inside the app itself. The vibe is 💫 main character energy for your own syscall handler 💫.

When it intercepts, it sends a thread-directed SIGSYS signal to the thread right when that thread makes a system call. And no cap — if it's intercepted, the kernel does not execute the system call. periodt.

🌈 PR_SYS_DISPATCH_ON

Turns the whole mechanism on. iconic.

Once it's enabled, further system calls get selectively intercepted, and that depends on a control variable that your user space provides. So here's the deal with the args:

• off and size are the offset and size of one single contiguous memory region in the process address space. System calls coming from there are always allowed to execute, no matter what the control variable says. (Typically this area would include the memory region holding the C library. 🎀)
• switch points to a variable — a fast switch to allow/block syscall execution without the overhead of making another syscall to re-configure Syscall User Dispatch. Because the way that would be annoying, honestly 😭. This control variable can be set to either:
  • SYSCALL_DISPATCH_FILTER_BLOCK — block system calls from executing, or
  • SYSCALL_DISPATCH_FILTER_ALLOW — temporarily let them execute.

The kernel checks this value on every single syscall entry, and any unexpected value raises an uncatchable SIGSYS right then and there, killing the application. 💀 so like. be normal about it.

When a system call gets intercepted, the kernel sends a thread-directed SIGSYS signal to the triggering thread. And various fields get set in the siginfo_t structure (see sigaction(2)) that comes with the signal:

• si_signo will contain SIGSYS.
• si_call_addr will show the address of the system call instruction.
• si_syscall and si_arch will indicate which system call was attempted.
• si_code will contain SYS_USER_DISPATCH.
• si_errno will be set to 0.

Also the program counter will be as though the system call happened — meaning the program counter will not point to the system call instruction. sneaky but correct.

When the signal handler returns back to the kernel, the system call completes immediately and returns to the calling thread, without actually being executed. And if necessary — i.e., when emulating the system call on user space — the signal handler should set the system call's return value to a sane value, by modifying the register context stored in the ucontext argument of the signal handler. See sigaction(2), sigreturn(2), and getcontext(3) for more info. bestie homework 📖

🌙 PR_SYS_DISPATCH_OFF

Syscall User Dispatch is disabled for that thread. simple as that.

⚠️ heads up: this setting is not preserved across fork(2), clone(2), or execve(2). it does not travel. it does not follow you. 🙈

---

🌟 RETURN VALUE 🌟

On success, 0 is returned, slay. On error, -1 is returned, and errno is set to indicate the error. 💅

---

🔥 ERRORS 🔥

• EFAULT — switch is an invalid address.
• EINVAL — op is PR_SYS_DISPATCH_ON and the memory range specified is outside the address space of the process.
• EINVAL — op is invalid.

---

👑 STANDARDS 👑

Linux. x86 only. 💀 that's it that's the whole thing.

---

🎀 HISTORY 🎀

Linux 5.11 (x86). a classic, honestly.

---

🫶 SEE ALSO 🫶

• prctl(2)

For more information, see the kernel source file Documentation/admin-guide/syscall-user-dispatch.rst 📚✨

---

and that's the whole page, bestie 💖 this cutie came to you straight from Linux man-pages 6.20, dated 2026-02. go intercept some syscalls responsibly, mwah 🎀🦋