Linux ​

#include <fcntl.h>
#include <unistd.h>
#include <sys/stat.h>

// 文件描述符操作
int open(const char *pathname, int flags, mode_t mode);
ssize_t read(int fd, void *buf, size_t count);
ssize_t write(int fd, const void *buf, size_t count);
int close(int fd);

// 示例：文件复制
int copy_file(const char *src, const char *dst) {
    int src_fd = open(src, O_RDONLY);
    int dst_fd = open(dst, O_WRONLY | O_CREAT | O_TRUNC, 0644);
    
    char buffer[4096];
    ssize_t bytes_read;
    
    while ((bytes_read = read(src_fd, buffer, sizeof(buffer))) > 0) {
        write(dst_fd, buffer, bytes_read);
    }
    
    close(src_fd);
    close(dst_fd);
    return 0;
}

#include <unistd.h>
#include <sys/wait.h>
#include <signal.h>

// 进程创建和执行
pid_t fork(void);
int execve(const char *pathname, char *const argv[], char *const envp[]);
pid_t waitpid(pid_t pid, int *wstatus, int options);

// 信号处理
int kill(pid_t pid, int sig);
sighandler_t signal(int sig, sighandler_t handler);

// 示例：创建子进程
pid_t child_pid = fork();
if (child_pid == 0) {
    // 子进程
    execl("/bin/ls", "ls", "-l", NULL);
    exit(1);  // 如果exec失败
} else if (child_pid > 0) {
    // 父进程
    waitpid(child_pid, NULL, 0);
}

#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

// 网络通信
int socket(int domain, int type, int protocol);
int bind(int sockfd, const struct sockaddr *addr, socklen_t addrlen);
int listen(int sockfd, int backlog);
int accept(int sockfd, struct sockaddr *addr, socklen_t *addrlen);
ssize_t send(int sockfd, const void *buf, size_t len, int flags);
ssize_t recv(int sockfd, void *buf, size_t len, int flags);

// 示例：TCP服务器
int create_tcp_server(int port) {
    int sockfd = socket(AF_INET, SOCK_STREAM, 0);
    
    struct sockaddr_in addr = {
        .sin_family = AF_INET,
        .sin_port = htons(port),
        .sin_addr.s_addr = INADDR_ANY
    };
    
    bind(sockfd, (struct sockaddr*)&addr, sizeof(addr));
    listen(sockfd, 10);
    return sockfd;
}

#include <linux/init.h>
#include <linux/module.h>
#include <linux/kernel.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Your Name");
MODULE_DESCRIPTION("A simple Linux driver");

static int __init hello_init(void) {
    printk(KERN_INFO "Hello, Linux Kernel!\n");
    return 0;
}

static void __exit hello_exit(void) {
    printk(KERN_INFO "Goodbye, Linux Kernel!\n");
}

module_init(hello_init);
module_exit(hello_exit);

#include <linux/fs.h>
#include <linux/cdev.h>

static int device_open(struct inode *inode, struct file *file) {
    printk(KERN_INFO "设备被打开\n");
    return 0;
}

static ssize_t device_read(struct file *filp, char __user *buffer, 
                          size_t length, loff_t *offset) {
    const char *message = "Hello from kernel!\n";
    size_t message_len = strlen(message);
    
    if (*offset >= message_len)
        return 0;
        
    if (length > message_len - *offset)
        length = message_len - *offset;
        
    if (copy_to_user(buffer, message + *offset, length))
        return -EFAULT;
        
    *offset += length;
    return length;
}

static struct file_operations fops = {
    .open = device_open,
    .read = device_read,
};

// 使用命名空间进行进程隔离
#define _GNU_SOURCE
#include <sched.h>
#include <sys/wait.h>
#include <sys/mount.h>

int create_container() {
    int container_pid = clone(
        container_main,
        container_stack + STACK_SIZE,
        CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWNET | SIGCHLD,
        NULL
    );
    
    return container_pid;
}

int container_main(void *arg) {
    // 设置主机名
    sethostname("container", 9);
    
    // 挂载proc文件系统
    mount("proc", "/proc", "proc", 0, NULL);
    
    // 执行容器内的命令
    execl("/bin/bash", "/bin/bash", NULL);
    
    return 0;
}

#include <sys/capability.h>

// 放弃不必要的权限
int drop_privileges() {
    cap_t caps = cap_init();
    
    // 只保留网络绑定能力
    cap_value_t cap_list[] = { CAP_NET_BIND_SERVICE };
    cap_set_flag(caps, CAP_EFFECTIVE, 1, cap_list, CAP_SET);
    cap_set_flag(caps, CAP_PERMITTED, 1, cap_list, CAP_SET);
    
    if (cap_set_proc(caps) == -1) {
        return -1;
    }
    
    cap_free(caps);
    return 0;
}