---
title: "What an Operating System Is: Privilege and System Calls"
description: "An operating system manages resources and provides services. In the user/kernel protection model studied here, user code cannot execute restricted hardware-control instructions. System calls enter the"
canonical: https://lightmysky.com/learn/computing/what-an-operating-system-is-privilege-and-system-calls-mt_0kMavEKxpX
source: https://lightmysky.com/learn/computing/what-an-operating-system-is-privilege-and-system-calls-mt_0kMavEKxpX.md
retrieved: 2026-11-12
---

> **Agent view.** This is the Markdown twin of the page, for tools and assistants.
> When to use this site, and the call that answers each job: https://lightmysky.com/agent-instructions.md
> API description (OpenAPI 3.1): https://lightmysky.com/openapi.json · Authentication: https://lightmysky.com/auth.md
> Pricing: https://lightmysky.com/pricing.md · Catalog: https://lightmysky.com/llms.txt · Full catalog: https://lightmysky.com/llms-full.txt
> Every machine-readable file on this domain: https://lightmysky.com/.well-known/ai-catalog.json
> Ask for Markdown with `Accept: text/markdown`, a `.md` address, or `?mode=agent`.

# What an Operating System Is: Privilege and System Calls

An operating system manages resources and provides services. In the user/kernel protection model studied here, user code cannot execute restricted hardware-control instructions. System calls enter the kernel for checked services. CPU privilege, permission to request a service, and ordinary library calls are distinct.

Subject: Computing · Area: Computer Systems · Ages 19 to 20
Page: https://lightmysky.com/learn/computing/what-an-operating-system-is-privilege-and-system-calls-mt_0kMavEKxpX

## Ready when they can

- Trace what happens on a system call, from the trap to the return
- Distinguish restricted hardware-control instructions from user-mode requests for permitted OS services
- Distinguish a library call that stays in user mode from a system call, and explain why their costs depend on the work performed

## Lesson: User mode, kernel mode and checked requests

Multiple cores do not create the need for an OS; a single-core computer can use one too. An OS manages resources and provides services. Here we study protected user programs and a kernel. An app saving a file requests an OS service rather than controlling the storage device itself. Other systems can use different protection arrangements.

*(drawing: For this file-read model, the program prepares a request, enters kernel mode, receives a checked result or error, and resumes in user mode.)*

CPU privilege restricts particular hardware-control instructions. In our model, user code cannot directly change memory-protection control registers, disable hardware interrupts, or operate unassigned device controls. It can perform ordinary arithmetic. These restrictions differ from permission to ask the OS for a service. An authorized user program can request a clock change without executing privileged instructions itself.

Protection limits what one user program can do to another's memory and shared resources. If every program could change memory protection or issue unrestricted device commands, one could damage another's data. The kernel checks requests and uses controlled interfaces. Protection reduces these risks; it does not guarantee that the kernel, drivers or every program will be free of faults.

Creating a folder is an ordinary request available to an app with suitable permissions. The app remains user-mode software, but the request can enter the kernel to update the file system. Permission to request the action is not permission to execute restricted CPU instructions. Calling a service does not give the app permanent kernel privilege.

Entering kernel mode does not mean a request must be approved. The kernel checks arguments, file permissions and other policy rules. A file-read request may return an error, read cached data, or wait for storage. The system-call interface controls entry; the checks decide which requested work is allowed.

A library function can compute entirely in user mode or wrap a system call. Kernel entry, checks and return add work compared with an otherwise similar user-only call, but total cost depends on the task. Ordinary desktop apps also depend on OS services. Install a suitable OS before those apps on an empty desktop disk; firmware and bare-metal software can execute without an installed OS.

**Recap.** In this protection model, user programs request checked kernel services. CPU privilege differs from service permission. A library function may stay in user mode or invoke a system call.

*Original lesson, questions and flashcards written for this dataset.*

## Practice

8 questions on this page, each with its working shown.

## Needs first

- [Many Cores and the Limit on Speedup](https://lightmysky.com/learn/computing/many-cores-and-the-limit-on-speedup-mt_dy3-K9dV19)

## Optional connections

- [Instruction Set Architecture as a Contract](https://lightmysky.com/learn/computing/instruction-set-architecture-as-a-contract-mt_pbwHRePY5M)

## Opens up

- [Authentication, Authorisation and Secure Defaults](https://lightmysky.com/learn/computing/authentication-authorisation-and-secure-defaults-mt_ofIiD4Bbpk)
- [Processes, Context Switches and What They Cost](https://lightmysky.com/learn/computing/processes-context-switches-and-what-they-cost-mt_oiOwHKUoXG)