The Structure of Linux Explained - How Linux Fits Together
Introduction
After a fresh install of Windows XP, you have three typical folders: Documents and Settings, Program Files and Windows. As we all know, Documents and Settings folder is where we save our files and where Windows keeps our personal settings, Program Files folder is where installed programs go to and Windows is the operating system’s own directory.
Linux, as in all computer operating systems, has its own files and folders. There are more than three folders and a very strict file/folder hierarchy defined by the Linux Standards Base. For example, the root directory, denoted with / is the parent of all the system; all other folders are children of root. The /home folder is similar to Documents and Settings, which keeps the files and preferences of the individual users. Each user’s folder is a child of the parent /home folder. There is one thing to note here, there is also a /root folder, which is the home directory of the root user.
As you have already figured out, Linux uses / (slash) in folder names, whereas Windows uses a \ (backslash.) [Ed: Windows allows the use of either the forward or back slash when designating directories at the command prompt.]
/mnt
I have to talk a little bit about mounting and the /mnt directory at first because I will use the word heavily in the article. I will describe this in detail later on in the article but for the time being just know that Linux treats all devices (I mean all devices such as hard disks, CDs, sound cards, printers and the like) as files. Mounting is a process which you make a device available for the system. For example when you plug a 2 GB USB stick, Linux looks at it and says “Hmm, this is an X brand external storage device, having 2 gigabytes of capacity, plugged in to the USB port and has a FAT32 filesystem. OK, I understood it, I can read and write files to/from it.”, in other words, Linux “mounts” it.
Linux mounts all the devices, be it the filesystem or the hardware, under the /mnt directory. You can also mount folders/devices manually. For example, assume that you have a secondary hard disk, which is recognized as /dev/sdb1 in your system. You can mount this hard disk by issuing mount /dev/sdb1 /home/yourusername/newdisk command as root. After that you can access your disk by simply changing to the newdisk folder under your home directory.
/bin
This folder contains the essential commands that both system administrators and regular users use to work with the computer. In most of the distributions the shells (bash, sh, tcsh, zsh etc.) are also contained in this folder. The commands that are in /bin directory are cp (copy), mv (move), login, chgrp (change group), chmod (change file access permissions), chown (change file/folder ownership), date (displays system time), ps (view status of the processes) and others such as dd, df, hostname, kill, dd, su. You can have a look at the /bin contents by issuing ls /bin from the command line.
The commands are considered essential because even in single user mode (for more information about user modes or runlevels, you can check How Linux Works article) you are able to use the commands.
/boot
As you might have guessed, this folder contains all the information about the boot process, but before the kernel starts to execute user-space programs. Typically the files and folders present in this directory are boot.b (the basic boot sector), chain.b (chainloader which is used to boot other operating systems in the computer that are not Linux), config-kernel-version (the configuration of the current kernel version that is used to boot the computer), map (the file that contains the location of the kernel), vmlinuz (kernel or the symbolic link to the kernel), /boot/grub (the directory that holds the grub bootloader, its configuration files, welcome message, background image.)
/dev
The folder holds the information about all the devices that are connected to the computer. This folder is very interesting in the sense of how Linux interacts with the devices: for Linux every device is actually a file. This seems confusing at first, but let’s think about a text file: you can create it, make changes to it, save it, delete (or remove) it. And let’s think about a hard disk where you can add another hard disk, make changes (partition it for example), save it (an internal hard drive) or remove it (an external hard drive.) As you see both possess more or less the same properties.
In the /dev folder, the devices usually are named ending with 0. For example, if you have two CD-ROMs connected to your computer, one is scd0 and the other is scd1. The same way, ttyS0 is the first serial port, lp0 is the first parallel port etc.. The main exception is the hard disks, which start with a (first hard disk is sda or hda, the second is sdb or hdb) and continue alphabetically.
/etc
This is the center of the system that holds all the configuration files. Most of the configuration files in Linux are plain text files, which you can open up with a text editor and make changes. /etc holds many files and folders and I will not go into the details of everything, but the basic building blocks. X11 files and folders are related to your X Windows system (roughly your main graphical user interface configuration such as graphics card, desktop manager configuration etc.), adduser (adding users to the system, the configuration file), autoconf (configuration of the autoconf program which processes the installation scripts), chatscripts (allows connection to your internet service provider), crontab (configuration of the cron program which executes tasks at defined dates/times), cups (printing system), fstab (partitions mounted), hosts (network connection information), init (system initialization), mail (e-mail configuration), networks (the networks the system is currently connected to), samba (connecting to Windows computers on the network) and others. You can go through the /etc contents and see which file does what by issuing cat /etc/filename from the command line (such as cat /etc/fstab.)
/home
We all know that Linux is a true multi-user system. All the users’ (except the root user’s) individual “Documents and Settings” are assigned to this folder by their usernames. For example if you have user1 and user2 in the system, their directories are /home/user1 and /home/user2. These folders can only be viewed by the users themselves and the system administrator but of course, a user can give another user the permission to read/write to specific files/folders on the computer. Suppose that user1 wants to share his holiday photos with user2, located under the /home/user1/photos/holiday directory. He can give user2 the read permission to view the /home/user1/photos/holiday, thereby both sharing his photos plus forbidding any accidental delete by the user2.
In Linux notation, the user’s home directory can be represented with a ~ (tilde.) To change to your /photos/holidays directory from the command line, you can issue cd /home/myusername/photos/holidays or cd ~/photos/holidays.
/init.rd
/init.rd holds the information about the system’s startup, i.e. initialization. When the system boots, the bootloader loads a RAM disk, which is actually a program that is written on the main memory (RAM) which then mounts the / (root) filesystem and the various boot processes are started (kernel recognizes the hardware, then additional modules are loaded etc.) In this process init.rd is mounted as root in rw (read write) mode.
/lib
Almost every computer user is familiar with the files with dll extension on Windows computers. dll, which is the abbreviation of dynamic link libraries, are codes which other programs can access and use. In Linux, these type of libraries and additional kernel modules are located in /lib folder. In Linux notation, the library files have .so as part of their filename, for example libncurses.so is the library file of ncurses, which allows the developers to to write text-based user interfaces.
To see which program uses which libraries, you can issue ldd command_name from the terminal.
/lost+found
As all other computer operating systems, Linux has to be shutdown in the proper way. This can be going through the menus or issuing shutdown -h now (shutdown the computer now) command from the terminal as a root user (sudo shutdown -h now also works.) If the computer is not shut down as it should be, then Linux performs a file checking on the hard disk by the fsck (abbreviation for file system check) and tries to recover everything that has something wrong, such as corrupt files. Anything that fsck can not recover is placed here. Although you might be tempted to ask “why keep them on the hard disk if they can not be recovered?” There are two answers for this. First, you may still have a chance to recover them, mostly by moving/copying them to their original directory. Second, if you see any symbolic links, library files in the /lost+found directory, this signals that the programs associated with these files possibly will not work as intended. This case uninstalling/reinstalling (or reinstall if uninstall does not work) will get the program up and running again.
/media
/media directory, contrary to its name does nothing to do with your multimedia content such as music, photos and videos. Instead, media is a folder where removable drives are mounted, such as your USB thumb drive. Also, when you insert a CD/DVD in your computer, you can see it mounted under the /media directory.
/media is a very useful directory long wished for the system administrators and users to easily see the removable devices. For example, if I plugged in my external hard disk, say HDEX, I had to undertake complicated tasks in the past such as mounting the disk manually, creating nodes, editing fstab etc.. After the introduction of the /media folder, these complicated things are done in the background, and I only go to /media/HDEX to access my hard disk. Of course, I have a HDEX shortcut in my desktop, but being a geek, I sometimes need some heavy typing in the command line to satisfy my nerdy gray cells.
/opt
With this directory, you are right. It gets its name from “optional” because the files, folders, commands that are under /opt are not required normally by the operating system to function. Programs such as Firefox, OpenOffice.org, GIMP are placed under this folder. As you see, the operating system can not function if it can not copy or move files around, but it can perfectly act as a server without having OpenOffice.org installed.
In your Linux box, the installed programs’ executable files can be found under /opt/program_name/bin directory.
/proc
Welcome to the most interesting directory of the Linux file system. /proc is a virtual directory, or a pseudo-file system which does not include any files, but has a lot of them. Let me try to make this more clear. /proc is actually a folder which contains files that are created only when the system is running. The files in the directory have a file size of zero, so they are practically some shortcuts (or windows if you will) that points you to where actual information is.
Let me take it with an example, suppose that you want to know more about your processor (CPU.) During the start up, Linux kernel checks your processor, notes its flags (such as mmx, sse, pae instructions) and recognizes it. What if you want to see this information? You have to search the logs for the contents, you will go to the Internet and search for this specific processor and try to understand it. Or, the Linux way, you can type cat /proc/cpuinfo and learn everything (don’t be shy, try cat /proc/meminfo to learn about your main memory.)
/proc is not limited to checking some hardware information. It also has processes by their Process ID’s (PIDs.) Suppose that you are running a Gnome desktop manager. Checking the contents of /proc, you see that Gnome display manager is running with PID 4835. You can type cat /proc/4835 and see what the process is actually doing at this moment.
/root
/root is the home folder of the root user. In the early days, when I started playing with Linux, there was no /root directory, meaning that the system administrators can create any folder for themselves in the file system. This “root on root” concept became very confusing because the root user’s home directory was the system root, i.e. /. To overcome this confusion, Linux distributions now create a /root folder during the system installation. Linux standards dictate that the system should be such that, if a /root folder cannot be found, the system will default to the / directory.
/sbin
When we were discussing about the /bin directory, I have told that the essential commands are located in /bin. There is a distinction to make here which are the essential commands. Essential commands are the ones who are needed for system maintenance, such as copying and moving files, managing access permissions etc. The other commands, which are for administration purposes, are located in this directory. According to the Linux standards, these commands are the ones for booting, restoring, recovering and/or repairing the system. The shutdown command I have told above is under /sbin directory, similar to fdisk (to manipulate partitions), halt (stop the system), ifconfig (network interface configuration), mkfs (command for making file systems) etc.
/usr
Welcome to the most crowded folder in the Linux file system. This directory contains the installed programs which are open to all users, the programs’ libraries, header files, manual pages, X Window system, telnet, ftp etc.. According to the Linux standards, /usr directory is shareable, meaning that all users can access the contents but can not modify them.
It is interesting to see that there is also a /sbin folder under /usr. The programs in /usr/sbin are the ones that can be run by the root only for system administration purposes. For example useradd command, which adds users to the system resides in /usr/sbin.
The /usr directory contains a lot of subdirectories which are very important to know one by one, such as /usr/local, /usr/include, /usr/bin, /usr/share, /usr/src. I strongly recommend you to google about these directories and learn about their contents if you want to move ahead with Linux.
/var
/var has its name from “variable”, which is a very precise definition for this folder. /var holds variable information about the system such as system logs, mail and printer spools and some temporary files. Commands and programs can write to the /var folder during their operations therefore the directory is not static as /usr.
/var is a directory you will be frequently visiting for system administration to analyze the logs.
/srv
/srv contains site-specific data, if the Linux system is acting as a server. The subfolders are listed by protocol, such as www, ftp, rsync etc..
/tmp
This is a directory which is used by the programs that need to create files temporarily and this is where the directory gets its name (temporary.) The files that are created during the normal operating process are usually deleted during boot or shutdown. I suggest you not to pay too much attention to the contents of this folder (the files are some couple of kilobytes, so you do not need to think about the size) and leave it as it is. If you want to play with the files, make sure that you know what you are doing, otherwise you can cause a system crash.
Conclusion
It is very important for the Linux system administrator to know which folder is about what. It is also a good practice to know the important files located under these folders since it will save you a lot of time (and sanity) when you are stuck at some place and need to do some administrative tasks. I strongly recommend you to take this article as your starting point and read about the Linux file system in detail. Just play with the files a little bit, make some minor changes and see how it affects your overall system. Start with what you think you can do, for example changing your login password, and then move on to changing root password and then adding users and during all these observe the changes in /etc/shadow file, which holds all these information.
