sdlc.dev

Linux path · Files and users · Topic 5 of 12

The filesystem tree, and everything is a file

Not started

Linux has one directory tree starting at /. Each disk partition, network share or in-memory filesystem is mounted onto a directory in that tree, so paths never start with a drive letter. "Everything is a file" means that regular files, directories, devices, pipes and sockets are all reached through the same few calls (open, read, write, close) on a file descriptor. The kernel uses the same idea to show its own state: /proc and /sys are filesystems whose files are generated on demand.

Why it matters: Knowing where things live, and that /proc and /sys are the kernel answering questions, turns debugging a process into reading a few files.

  1. 1One tree from /

    Disks, partitions, network shares and in-memory filesystems are all mounted somewhere under a single root.

  2. 2Same calls for everything

    Files, devices, pipes and sockets are all used through open, read, write and close on a descriptor.

  3. 3/proc is the kernel talking

    Its files are generated when you read them: each process's state, memory maps, open files and limits, plus system-wide counters.

  4. 4/sys is the device and driver model

    Devices, drivers, network interfaces and cgroups appear as directories with one value per file.

1

How it works

The explanation, with examples you can run.

Where things live

PathWhat is there
/etcConfiguration, mostly plain text
/usr/bin, /usr/libInstalled programs and libraries (/bin and /lib are symlinks to them on modern distributions)
/varData that changes: /var/log, /var/lib (databases, package state), /var/cache
/home, /rootUsers' home directories
/tmp, /runTemporary files; /run holds runtime state such as PID files and sockets, emptied at boot
/devDevice files: /dev/null, /dev/sda, /dev/pts/0
/proc, /sysThe kernel's view of processes, devices and settings

mount or findmnt lists what is mounted where; df -h shows how full each filesystem is.

/proc: ask the kernel about a process

sleep 300 &tr '\0' ' ' < /proc/$!/cmdline; echogrep -E '^(Name|State|PPid|VmRSS|Threads)' /proc/$!/statusreadlink /proc/$!/exe /proc/$!/cwd
sleep 300 Name:	sleepState:	S (sleeping)PPid:	3631VmRSS:	    1284 kBThreads:	1/usr/bin/sleep/

Each PID has a directory with dozens of entries: cmdline (arguments, NUL-separated), environ, status, fd/ (open descriptors), maps (memory mappings), limits, cgroup, ns/ (namespaces) and more. This is where ps, top, lsof and free get their numbers. /proc/self is always the process doing the reading.

There are system-wide files too: /proc/meminfo, /proc/loadavg, /proc/cpuinfo, and /proc/sys/, where kernel settings live (sysctl vm.swappiness reads /proc/sys/vm/swappiness). None of it is stored anywhere:

stat -c '%s bytes' /proc/meminfo; wc -c < /proc/meminfo
0 bytes1392

/sys: devices and drivers

/sys (sysfs) exposes the kernel's device model as one value per file, which is easy for scripts to read:

ls /sys/class/netcat /sys/class/net/eth0/mtucat /sys/fs/cgroup/cgroup.controllers
bonding_masterserspan0eth0gre0gretap0ip6_vti0ip6gre0ip6tnl0ip_vti0losit0tunl065535cpuset cpu io memory hugetlb pids rdma

Besides eth0 and loopback lo, Docker Desktop's kernel shows a set of tunnel devices that are never configured. /sys/class/net lists network interfaces, /sys/block disks, and /sys/fs/cgroup is the cgroup tree that resource limits and containers are built on. Some files are writable by root to change settings, and inside a container /sys is usually mounted read-only.

Device files

ls -l /dev/null shows crw-rw-rw- and 1, 3 where a size would be: c is a character device and 1, 3 are the major and minor numbers that select the driver. Reading /dev/urandom gives random bytes, writing to /dev/null discards data, and the terminal you type in is /dev/pts/N.

On macOS

macOS has a single tree from / as well, but no /proc or /sys. The same questions are answered by commands: ps, lsof -p <pid>, vm_stat, sysctl -a and ioreg. Its layout also differs: user homes are in /Users, and /tmp and /var are symlinks into /private.

2

Check yourself

3 questions. Get them all right to finish this topic.

  1. 1.ls -l /proc/meminfo shows a size of 0, yet cat prints many lines. Why?
  2. 2.Where would you look to see which files a running process (PID 4242) has open?
  3. 3.Which directory is the conventional place for a service's changing data such as logs, caches and databases?

0 of 3 right so far. Get all three to finish this topic.

Go deeper