What information does stat return about a file?

A strong answer

A strong candidate frames What information does stat return about a file? around the exact memory layout, compiler semantics, and hardware execution model covered in File Metadata, Permissions, and Inodes with stat. Explain the struct stat fields: inode, device, mode, size, timestamps, link count, and the difference between symlink and target metadata.

Applications often need to inspect file properties before reading or writing data:

• Determining whether a path is a regular file, a directory, a character device, or a socket.
• Checking file permissions to verify if the current user has read or write access.
• Querying total file size to allocate an appropriately sized memory buffer.

This code contains a critical security vulnerability known as a Time-of-Check to Time-of-Use (TOCTOU) race condition.

In a production interview, always connect the specification rule to its concrete runtime consequence: state what lives on the stack versus the heap or static storage segment, how the compiler or operating system validates alignments, lifetimes, and error codes, and what happens under adversarial or boundary inputs (such as zero-length buffers, integer overflow, concurrent mutation, or partial I/O). Backing your explanation with a small trace of register/memory state transitions immediately separates senior systems engineers from candidates who only memorized syntax.

What the interviewer is listening for

• Mastery of core invariant: Query file metadata using stat, lstat, and fstat system calls.
• Mastery of core invariant: Decode file types and permission bits from st_mode using POSIX bitmasks and macros.
• Mastery of core invariant: Distinguish inode status change time (ctime) from file creation time.
• Hardware and ABI awareness: Explaining how sizes, alignments, calling conventions, or kernel boundaries behave on real 64-bit targets rather than relying on implementation-defined assumptions.
• Defensive engineering: Naming the exact compiler flags (-Wall -Wextra -Werror), static analyzers, or runtime sanitizers (-fsanitize=address,undefined,thread) that verify correctness in CI.

Common mistakes

• Explaining only surface syntax without tracing the underlying memory addresses, ownership lifetime, or kernel/user-space state transitions.
• Assuming undefined behavior (such as signed overflow, uninitialized reads, strict-aliasing violations, or dangling pointers) will "just work" because it passed an unoptimized -O0 debug build.
• Ignoring return codes, partial reads/writes, alignment padding, or cleanup paths when an allocation or syscall fails midway through a function.