# Feature catalog — torvalds/linux

> Canonical page: https://codevetter.com/unpack/linux/feature-catalog

# Feature catalog — torvalds/linux

Scanned commit f0100363d8c374bd8e9ea7c9ba02744f0b802ca4 (2026-09-21). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

User-visible features are the syscall surface plus pseudo-filesystems and kernel subsystems. The catalog spans process management (fork/clone3/execve), file I/O (openat2, read/write family, io_uring), sockets and the full network stack, loadable modules, eBPF programs/maps, namespaces and cgroups, SysV/POSIX IPC, the crypto API with AF_ALG userspace access, pluggable schedulers (including BPF-extensible sched_ext), security modules (SELinux, AppArmor, Smack, TOMOYO, Landlock, IPE, Yama, LoadPin), tracing (ftrace, perf events) and sysctl/procfs/sysfs configuration interfaces.
- File-opening syscalls open, openat, openat2 and creat are defined in fs/open.c via SYSCALL_DEFINE macros; openat2 takes an extensible struct open_how copied with copy_struct_from_user and size-bounded against OPEN_HOW_SIZE_VER0/PAGE_SIZE. — [fs/open.c#L1427-1467](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/fs/open.c#L1427-L1467) [fs/open.c#L1495-1499](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/fs/open.c#L1495-L1499)
- The read/write syscall family (read, write, lseek, readv, writev, pread64, pwrite64, preadv2, pwritev2 and compat variants) is implemented in fs/read_write.c, all funneling to vfs_read/vfs_write which dispatch to f_op->read or f_op->read_iter via new_sync_read/new_sync_write. — [fs/read_write.c#L412-580](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/fs/read_write.c#L412-L580) [fs/read_write.c#L705-750](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/fs/read_write.c#L705-L750) [fs/read_write.c#L991-1222](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/fs/read_write.c#L991-L1222)
- Process creation syscalls fork, vfork, clone and clone3 are all implemented in kernel/fork.c and converge on kernel_clone() -> copy_process(); clone3 takes a versioned struct clone_args validated by clone3_args_valid/clone3_stack_valid. — [kernel/fork.c#L2715-2873](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/fork.c#L2715-L2873) [kernel/fork.c#L2983-3051](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/fork.c#L2983-L3051)
- execve program loading lives in fs/exec.c, which opens the target via do_file_open() and hands off to registered binary-format handlers such as fs/binfmt_elf.c for ELF binaries. — [fs/exec.c#L780-790](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/fs/exec.c#L780-L790) [fs/binfmt_elf.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/fs/binfmt_elf.c)
- The BSD socket API is implemented in net/socket.c: SYSCALL_DEFINE3(socket) -> __sys_socket -> __sys_socket_create -> __sock_create, wrapped by security_socket_create/security_socket_post_create LSM hooks, with sock_create_lite available for in-kernel sockets. — [net/socket.c#L1453-1493](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/net/socket.c#L1453-L1493) [net/socket.c#L1591-1832](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/net/socket.c#L1591-L1832)
- io_uring provides the async I/O interface: SYSCALL_DEFINE2(io_uring_setup) creates the ring, SYSCALL_DEFINE6(io_uring_enter) -> io_submit_sqes consumes SQEs and calls io_issue_sqe, which dispatches per-opcode through the io_issue_defs[] table in io_uring/opdef.c. — [io_uring/io_uring.c#L1368-1450](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/io_uring/io_uring.c#L1368-L1450) [io_uring/io_uring.c#L2013-2637](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/io_uring/io_uring.c#L2013-L2637) [io_uring/io_uring.c#L3136](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/io_uring/io_uring.c#L3136) [io_uring/opdef.c#L54-79](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/io_uring/opdef.c#L54-L79)
- The bpf(2) syscall multiplexes eBPF map/program/link operations; bpf_prog_load() runs the 21k-line verifier (kernel/bpf/verifier.c) before a program may attach, and every step is gated by security_bpf* LSM hooks. — [kernel/bpf/syscall.c#L2605-2917](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/bpf/syscall.c#L2605-L2917) [kernel/bpf/syscall.c#L3133](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/bpf/syscall.c#L3133) [kernel/bpf/verifier.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/bpf/verifier.c) [include/uapi/linux/bpf.h](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/include/uapi/linux/bpf.h)
- The scheduler implements multiple classes — EEVDF/fair (fair.c), realtime (rt.c), deadline (deadline.c), idle (idle.c) — plus sched_ext in kernel/sched/ext/, which lets BPF programs implement custom scheduling policies. — [kernel/sched/core.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/sched/core.c) [kernel/sched/ext/ext.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/sched/ext/ext.c) [kernel/sched/fair.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/sched/fair.c) [kernel/sched/rt.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/sched/rt.c)
- Filesystems self-register through register_filesystem()/unregister_filesystem() in fs/filesystems.c; the tree ships ~50 filesystems including ext4, btrfs, f2fs, xfs, nfs and procfs (fs/proc/root.c). — [fs/filesystems.c#L88-120](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/fs/filesystems.c#L88-L120) [fs/ext4/super.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/fs/ext4/super.c) [fs/btrfs](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/fs/btrfs) [fs/xfs](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/fs/xfs) [fs/proc/root.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/fs/proc/root.c)
- Module administration syscalls init_module/finit_module/delete_module are exposed in kernel/module/main.c, gated on CAP_SYS_MODULE and modules_disabled, with signature enforcement under CONFIG_MODULE_SIG/MODULE_SIG_FORCE. — [kernel/module/main.c#L804](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/module/main.c#L804) [kernel/module/main.c#L3647-3667](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/module/main.c#L3647-L3667) [kernel/module/Kconfig#L252-295](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/module/Kconfig#L252-L295)
- System V IPC (msg.c, sem.c, shm.c) and POSIX message queues (mqueue.c) live in ipc/, with per-namespace accounting in ipc/namespace.c; process namespaces are managed in kernel/nsproxy.c and kernel/pid_namespace.c. — [ipc/msg.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/ipc/msg.c) [ipc/sem.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/ipc/sem.c) [ipc/shm.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/ipc/shm.c) [ipc/mqueue.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/ipc/mqueue.c) [kernel/nsproxy.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/nsproxy.c)
- Observability subsystems include ftrace/tracepoints (kernel/trace/trace.c), perf events (kernel/events/core.c) and the printk ring buffer (kernel/printk/printk.c); sysctl tables are registered through kernel/sysctl.c with subsystem additions such as mm/hugetlb_sysctl.c. — [kernel/trace/trace.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/trace/trace.c) [kernel/events/core.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/events/core.c) [kernel/printk/printk.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/printk/printk.c) [kernel/sysctl.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/sysctl.c) [mm/hugetlb_sysctl.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/mm/hugetlb_sysctl.c)
- The crypto API in crypto/ exposes symmetric/asymmetric algorithms and the AF_ALG socket family (af_alg.c, algif_*.c) so userspace can request kernel crypto operations via sockets. — [crypto/af_alg.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/crypto/af_alg.c)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)