Linux

A loadable kernel module is kernel code — typically a driver or filesystem — shipped as a separate .ko file and inserted into the running kernel on demand. Code built in with =y is part of the kernel image itself and can never be unloaded.

/proc is procfs, a virtual filesystem with no storage behind it. The kernel generates each file's contents at the moment a process reads it, so the reported size is 0 while the data returned is a live snapshot of kernel state.

User space is the unprivileged CPU mode, where a process sees only its own virtual memory and cannot touch hardware; kernel space is the privileged mode. A process crosses over only by issuing a system call, a hardware trap that enters the kernel at one fixed, kernel-chosen entry point.

Firmware initialises the hardware and loads a bootloader; the bootloader loads the compressed kernel plus an initramfs into memory; the kernel unpacks itself, runs the initramfs to reach the real root filesystem, switches onto it, and execs the system's init as PID 1.

modprobe resolves dependencies: it looks the module up by name in modules.dep under /lib/modules/<kernel release> and loads everything it needs first, in order. insmod inserts exactly one file, so a module whose prerequisites are missing fails with an unknown-symbol error.

Configuration lives under /etc, persistent state under /var/lib and logs under /var/log. The split is by mutability and ownership: /usr holds static package-owned code, /etc holds locally editable configuration, /var holds data the machine writes while it runs.

A hard link is an extra name for the same inode, so every name is equal and the data survives until the last one is removed. A symbolic link is a separate small file holding a path string, resolved at every access.

Kernel names like /dev/sdb1 depend on device discovery order, so a new disk or a slow controller can renumber them and mount the wrong filesystem. Prefer UUID= from the filesystem superblock, or PARTUUID= from the partition table.

/usr is owned by the distribution's package manager, so an upgrade can overwrite or conflict with anything you drop there. /usr/local is reserved for software the administrator installs and packages never touch. /opt holds self-contained third-party bundles in their own subtree.

ext4's journal protects filesystem metadata consistency, not file contents. The default data=ordered flushes data blocks before committing the metadata that points at them; data=writeback drops that ordering and can expose stale bytes; data=journal journals data too, more slowly.

Linux capabilities break root's all-or-nothing power into more than forty independent privileges that can be granted to a process or an executable one at a time. CAP_NET_BIND_SERVICE is the one that allows binding to ports below 1024.

Enforcing blocks policy violations and logs them. Permissive blocks nothing but still logs every would-be denial. Disabled loads no policy and stops maintaining file labels. setenforce 0 switches to permissive only until reboot; /etc/selinux/config sets the mode chosen at boot.

The first character gives the file type; the next nine are three rwx triads for owner, group and others. So -rw-r--r-- is a regular file the owner can read and write while everyone else can only read: octal 644.

/etc/passwd holds one line per account — name, UID, primary GID, real name, home directory and login shell — and is world-readable. /etc/shadow holds the password hashes and ageing fields, readable only by root. /etc/group lists groups and their extra members.

The mask entry is an upper bound on every named user, named group and the owning group; rights above it are granted but not effective. It is most often narrowed by a later chmod, because on an ACL-bearing file the group-class mode bits map to the mask, not to the owning group.

Namespaces control what a process can see: its own PIDs, mounts, network stack, hostname. Cgroups control how much it may consume: CPU time, memory, I/O, process count. Starving the machine is a resource problem, so the answer is a cgroup.

SIGTERM is a polite request: the process can catch it and shut down cleanly. SIGKILL is enforced by the kernel — the target never runs code for it, so buffers, lock files and in-flight work are abandoned as they are.

A zombie is a process that has already terminated but whose parent has not yet collected its exit status. The kernel keeps only its process-table entry, PID and exit code; it disappears as soon as the parent waits on it.

No. Linux spends otherwise-idle RAM on page cache for file data and reclaims it on demand, so near-zero free memory is normal and healthy. The number that matters is available, which estimates what a new process could still get.

A nice value biases how much CPU a Linux task gets when CPUs are contended. It runs from -20 (most favoured) to 19 (least favoured), default 0. Lowering it needs privilege, so an unprivileged renice is a one-way trip.

Each nameserver line gives the C library's resolver one DNS server address to query. They are tried strictly in the listed order, not load-balanced: the next one is used only after the previous fails or times out, and glibc reads at most three.

The default route is the 0.0.0.0/0 catch-all entry telling the kernel where to send packets that no more specific route matches, normally via a gateway. With no match at all the send fails locally and immediately with ENETUNREACH, "Network is unreachable".

Connection refused means the SYN reached the host and the kernel answered with a TCP RST because no socket was listening on that port. A hang means no answer came back at all, usually a dropped packet, so the client keeps retransmitting the SYN until it gives up.

They use different code paths. dig speaks DNS straight to a nameserver, while applications call getaddrinfo(), which follows the hosts: line of /etc/nsswitch.conf — static files, local modules, then DNS. A source ahead of DNS can answer first.

ip only edits live kernel state, which is never written to disk, so a reboot discards it. Persistence belongs to whichever manager owns the interface — NetworkManager, systemd-networkd, or netplan rendering to one of them — and that manager can also overwrite your address while running.

start activates a service right now; enable makes it come up automatically at boot. Enabling only creates a symlink so a boot target pulls the unit in — it launches nothing immediately, and starting alone does not survive a reboot.

Low-level tools (dpkg, rpm) install exactly the one file you hand them and merely report unmet dependencies. The resolver above them (apt, dnf, zypper) reads repository metadata, computes a complete transaction, fetches the missing packages, and only then calls the low-level tool.

The solver searches for a set of package versions that satisfies every declared relationship — requires, conflicts, obsoletes, provides — given what is installed plus everything the enabled repositories offer. Unmet means no such set exists; broken means the local database is already inconsistent.

rescue.target is the successor of single-user mode: basic system initialisation and local filesystems are up, with one root shell and no network or multi-user services. emergency.target is far more minimal — essentially just the root filesystem, often read-only, and a shell, used when the system cannot even reach rescue.

A systemd target is a named unit that groups other units and acts as a synchronisation point. Unlike a SysV runlevel, which was a single number with exactly one value active, many targets are active at once and reaching them is dependency-driven, not a numbered sequence.