File System Hierarchy

• initramfs
• systemd and paths
  • /etc/systemd/
  • /usr/lib/systemd/system/
  • /run/systemd/
• /lib/modules/, /lib/firmware/
• /etc/ld.so.conf.d/ — linker config

Item	Status	Action
initramfs	Missing	Add to /boot section
UEFI / /boot/efi	Missing	Add
systemd paths	Missing	Add section
/usr/lib/modules/, /usr/lib/firmware/	Missing	Add
/etc/ld.so.conf.d/	Missing	Add to etc section

Standards History

• https://specifications.freedesktop.org/fhs/latest/backgroundOfTheFhs.html
• FSSTND (Filesystem Standard): 1994 document that standardized the Linux filesystem layout
  • Linux-specific; limited in scope
  • superseded by FHS in 1994–1996
• FHS (Filesystem Hierarchy Standard): successor to FSSTND; broadened scope to all Unix-like systems
  • previously maintained by the Linux Foundation
  • currently maintained by FreeDesktop
• References
  • Latest FHS: https://specifications.freedesktop.org/fhs/latest/
  • FHS 3.0 (2015): https://refspecs.linuxfoundation.org/FHS_3.0/fhs/index.html
  • Linux Filesystem Hierarchy (unofficial) Guide (2004, TLDP): https://tldp.org/LDP/Linux-Filesystem-Hierarchy/html/index.html

UsrMerge project

• https://systemd.io/THE_CASE_FOR_THE_USR_MERGE/

/bin   --> /usr/bin
/sbin  --> /usr/sbin
/lib   --> /usr/lib
/lib64 --> /usr/lib64

View Filesystem Hierarchy

man hier

The Filesystem

• Shareable files are those that can be stored on one host and used on others
• Unshareable files are those that are not shareable
• Static files include binaries, libraries, documentation files and other files that do not change without system administrator intervention
• Variable files are files that are not static

	shareable	unshareable
static	/usr	/etc
	/opt	/boot
variable	/var/mail	/var/run
		/var/lock

Standard File System Hierarchy

Root Filesystem

• contents of Root filesystem should be adequate to boot, restore, recover, and/or repair the system.
• /boot
  • static files for the bootloader
  • stores data that is used before the kernel begins executing user−mode program
  • contains backup MBR data, boot data etc.
  • /sbin must contain programs to arrange for bootloader to boot a file
  • /etc contains config for boot loaders not required at boot time
  • OS kernel can be located at /boot or /
• /bin
  • /bin —> /usr/bin by UsrMerge project
  • essential command line binaries
  • commands for all users, both system admin and non-admin users
  • There should not be any sub-directories in /bin
  • See /bin
• /sbin
  • /sbin —> /usr/sbin by UsrMerge project
  • system (or superuser) binaries
  • executables used for system administration, not for regular users
  • essential for booting, restoring, recovering, and/or repairing the system
  • There should not be any sub-directories in /sbin
  • See /sbin
• /etc
  • contains all system related configuration files
  • should be static and cannot be executable binary
  • See /etc
• /mnt
  • mount point for temporary mounted filesystem
  • system administrator may temporarily mount a filesystem as needed
• /media
  • mount point for removable media like CD-ROM, External HDD
• /home (optional)
  • contains user home directories
  • /home/$USER
    • user specific config: dot files and dot directories
    • See XDG Base Directory Spec
• /root (optional)
  • home directory for administrator “root”
• /dev
  • contains device as files
  • uses devtmpfs In-memory file system
  • See /dev
• /proc
  • virtual filesystem exposing kernel and process runtime state
  • uses procfs In-memory file system
  • specific to Linux
  • used for monitoring the system
  • See /proc
• /sys
  • Kernel and system information virtual filesystem
  • information about devices, drivers, and some kernel features is exposed
  • uses sysfs filesystem
  • specific to Linux
  • used for configuring devices
  • See /sys
• /run
  • Runtime variable data
  • system information data describing the system since it was booted
  • Files under this directory must be cleared at the beginning of the boot process
  • should not be writable for unprivileged users
  • uses tmpfs In-memory file system
  • See /run
• /tmp
  • used by programs that require temporary files and regular users
  • may use tmpfs (RAM) or Physical storage (ext4 etc.)
  • May survive a reboot unlike /run
  • contains temporary caches, document drafts etc.
  • should not delete data similar to /run, can cause system crash
• /lib
  • /lib —> /usr/lib by UsrMerge project
  • shared library images (*.so) to boot system and and run the commands in the root filesystem
  • used by programs in /bin and /sbin
• /lib<qual> (optional)
  • /lib<qual> —> /usr/lib<qual> by UsrMerge project
  • one or more variants of /lib
  • for example /lib32 and /lib64 where /lib is symlink to one of them

Non-Root Filesystem

• /usr, /var, /opt are designed such that they may be located on other partitions or filesystems
• Despite they can be in another partition they are still essential for booting
• /usr
  • contains by far the largest share of data on a system
  • shareable and read-only data, meaning multiple computers could safely mount this partition
  • large software packages must not use a direct subdirectory under the /usr hierarchy
  • /usr/bin: same as /bin
  • /usr/sbin: same as /sbin
  • /usr/local: Locally compiled (installed) programs
    • empty in fresh installation
    • See /usr/local
  • /usr/share: shareable, architecture−independent files (docs, icons, fonts etc)
    • See /usr/share
  • /usr/games: games binaries
  • /usr/include: header files for user space source code
    • collaborative landing zone where several completely different core upstream open-source projects drop their respective API interface definitions (.h files) via your package manager
  • /usr/src: linux source code, only for reference purposes
    • To get the source you need to run apt install linux-source
  • /usr/libexec: internal binaries that are not intended to be executed directly by users or shell scripts
  • /usr/lib: same as /lib
  • /usr/lib<qual>: same as /lib<qual>
• /var
  • variable data like logging files, mail and printer spool, temporary files, lock files
  • can be mounted on separate device for backup purposes
  • can contain shareable or unshareable data
  • shareable
    • /var/mail: user mailbox files
    • /var/cache: application cache data
      • /var/cache/man
      • /var/cache/fonts
      • /var/cache/apt
    • /var/spool: application spool data
      • /var/spool/cron
  • unshareable
    • /var/log: log files and directories
    • /var/lock —> /run/lock
    • /var/run —> /run
  • /var/tmp: Temporary files preserved between system reboots
  • /var/lock: lock files
  • /var/lib: variable state information
  • /var/opt: variable data for /opt
  • /var/games: variable data for /usr/games
  • /var/account: accounting log
  • /var/crash: system crash dumps
• /opt
  • Reserved for all the software and add−on packages that are not part of the default installation
    • /opt/<package> by package
    • /opt/<provider>/<package> by provider’s LANANA registered name
  • /etc/opt for config files
  • /var/opt for variable files
• /srv: site−specific data which is served by this system
• /lost+found: rebooting after system crash
  • used by filesystems like ext4, xfs, f2fs
  • fsck tries to recover files and save here

Software Installation

• https://askubuntu.com/questions/1148/when-installing-user-applications-where-do-best-practices-suggest-they-be-loc
• https://unix.stackexchange.com/questions/8656/usr-bin-vs-usr-local-bin-on-linux
• UsrMerge project
• XDG Base Directory Spec

System Core

• /bin or /usr/bin: core unix utilities, system programs, standard user applications
  • managed by distribution package manager
• /sbin or /usr/sbin: system management and administrative infrastructure programs
  • managed by distribution package manager
  • not for normal users, requires privileges to run
  • Note: Arch and Fedora has merged these folders with /bin

Custom/Third Party

• /usr/local
  • locally compiled or manually installed packages for all users
  • /usr/local/bin
  • /usr/local/sbin
    • Note: Arch and Fedora has merged this folder with /usr/local/bin
• /opt
  • installation of pre-compiled (binary) packages like tarball of Firefox
• ~/.local/bin
  • modern XDG standard
  • user script or local program for single user

/bin

• Required binaries list: https://specifications.freedesktop.org/fhs/latest/bin.html
• shell: bash, csh etc.
• commands: cp, mv, echo, ls, mkdir, cat etc.
• apt programs??: vi, gcc, ftp, python
• chown, passwd, netstat, ss

/sbin

• Required binaries list: https://specifications.freedesktop.org/fhs/latest/sbin.html
• init, reboot, poweroff, systemctl
• ip, ifconfig, iptables, nftables, route, ethtool, sshd, arp
• fdisk, parted, mkfs.*, fsck.*, blkid, losetup, resize2fs
• mkswap, swapon, swapoff
• modprobe, lsmod, sysctl, chroot, dmidecode, depmod
• chroot, adduser, addgroup
• ldconfig

/dev

• all files have zero size
• /dev/stdin, /dev/stdout, /dev/stderr
• /dev/sda: HDD/SSD
• /dev/sda1: partition under /dev/sda
• /dev/disk
  • /dev/disk//by-uuid/: partition mapping with partition UUID, can be used safely in fstab instead of confusing sda/sdb
  • /dev/disk/by-id/: drive/partition mapping with factory serial number
  • /dev/disk/by-path/: drive/partition mapping with motherboard port
• /dev/null: All data written to this device is discarded
• /dev/zero:  All data written to this device is discarded
  • A read from this device will return as many bytes containing the value zero as was requested
• /dev/urandom: random number generator
• /dev/shm: shared memory
  • based on tmpfs In-memory filesystem
  • used as an IPC between processes
• /dev/pts: slave ends of PTY (Pseudo-Teletype or pseudo-terminal) pairs
  • a PTY has two ends:
    • master: held by the terminal emulator or SSH daemon
    • slave: the shell connects here; one entry created per session
  • echo "Hello" > /dev/pts/0 sends “Hello” to that terminal
• /dev/tty1 … /dev/tty63: virtual consoles or virtual terminals
  • TTY: Teletype or Teletypewriter
  • kernel supports up to 63 virtual console slots (tty1-tty63) by default
    • configurable at boot via maxvt=N kernel parameter
    • only a handful are activated by systemd; the rest have nothing running on them
  • X11-based distros (default convention):
    • tty1-tty6: text login shells
    • tty7: X11 display server (back to GUI)
    • tty8+: no login shell configured by default; can be enabled via systemd
  • Wayland-first distros (Ubuntu 22.04+, Fedora):
    • tty1: Wayland display server (back to GUI)
    • tty2-tty6: text login shells
    • tty7+: no login shell configured by default; can be enabled via systemd
  • Switching between virtual consoles:
    • keyboard: Ctrl+Alt+F1-F12 (covers tty1-tty12 only)
    • programmatically: sudo chvt N — can switch to any tty number
    • tty — see current terminal name
• /dev/tty0: alias for whichever virtual console is currently active
  • not a standalone console; writes to tty0 go to whatever ttyN is on screen
• /dev/tty: always refers to the controlling terminal of the current process
  • writes reach the screen even if stdout is redirected elsewhere
  • classic example: sudo writes the Password: prompt to /dev/tty, not stdout
    • so the prompt appears on screen even when you run sudo cmd > file.txt

Virtual Consoles vs Terminal Emulators

	Virtual Consoles	Terminal Emulators
Managed by	Linux kernel	Userspace GUI app
Requires GUI	No	Yes (X11 or Wayland)
Device	/dev/ttyN	/dev/pts/N (PTY slave)
Available during	Boot, recovery, no-GUI states	Desktop session (GUI) only
Features	Plain text, full screen	Tabs, custom fonts, scrollback, color

How PTY and TTY are connected

• ???

/proc

• aka process information pseudo−file system
• all files have zero size
• all files contain runtime system information
  • system memory, devices mounted, hardware configuration etc.
• many commands use this to display data
• /proc/{pid}/: process info
• /proc/filesystems: file systems supported
• /proc/version: current linux version
• /proc/diskstats: disk info
• /proc/meminfo: memory info
• /proc/cpuinfo: cpu info
• /proc/cmdline: exact arguments to bootloader when machine started
• /proc/mounts: A real-time, completely accurate list of every single filesystem currently mounted on your computer
• /proc/sys/: control panel for the Linux kernel
  • editable unlike other files in proc
  • allows you to modify kernel behavior on the fly without rebooting
  • sysctl is used to modify them internally
    • /proc/sys/net/: network engine settings
    • /proc/sys/vm/: virtual memory management
    • /proc/sys/fs/: file system limits
    • /proc/sys/kernel/: core kernel tuning
• https://www.reddit.com/r/linuxadmin/comments/1890gvk/why_does_the_proc_directory_exist/

/sys

• all files have zero size
• /sys/kernel/debug/
  • mount point for debugfs
  • monitor kernel performance and tracing
• /sys/fs/cgroup/
  • control groups hierarchy
  • allows systemd and container runtimes (like Docker) to strictly throttle CPU, memory, and I/O limits for specific processes
• /sys/class/power_supply/BAT0/status: Battery status
• /sys/class/power_supply/BAT0/capacity: Battery charge level

/etc

• User management
  • /etc/passwd: Stores core user account details like usernames, User IDs (UID), Group IDs (GID), home directories, and default shells
  • /etc/shadow: Holds securely hashed user passwords and password expiration policies, accessible only by root
  • /etc/group: Defines the system groups and lists which users belong to each group
  • /etc/sudoers: Controls which users or groups are granted administrative privileges via the sudo command
• Networking & DNS
  • /etc/hosts: Maps hostnames to IP addresses locally before DNS lookup
  • /etc/resolv.conf: Defines DNS resolvers (IP addresses of name servers)
  • /etc/hostname: Sets the system’s unique network hostname
  • /etc/networks: Network names
  • /etc/protocols: IP protocol listings
• Core System Configuration
  • /etc/fstab: Lists filesystems and devices to mount automatically during boot
  • /etc/environment: Global environment variables available to all users/processes
  • /etc/os-release: Linux distribution and OS version information
  • /etc/shells: Pathnames of valid login shells
  • /etc/profile: Systemwide initialization file for sh shell logins
• Automation & Services
  • /etc/crontab: Scheduled system-wide tasks
  • /etc/ssh/sshd_config: SSH server settings, including port numbers and remote login access rules
  • /etc/default/grub: Boot loader configuration (default OS selection, boot countdown timers, etc.)
• Others
  • /etc/systemd: Config for systemd
  • /etc/opt: Config files for /opt

/run

• /run/user/{uid} (used by user desktop session apps)
  • /run/user/{uid}/wayland-0: UNIX-domain socket for Wayland
• /run/media (standard location where modern desktop environments automatically mounts USB drives/external HDD etc.)
• Transient UNIX-domain sockets must be placed here
  • /run/docker.sock (used by docker engine)
  • /run/containerd/containerd.sock (used by K8s and container tools)
  • /run/dbus/system_bus_socket (The system-wide message bus that desktop environments use to talk to system hardware)
• Process Identifier (PID) files use naming convention <program-name>.pid
  • These files contain PID of the program
  • /run/crond.pid (tracks the background task scheduler)
  • /run/nginx.pid (tracks the active Nginx web server)
  • /run/sshd.pid (tracks the active OpenSSH server daemon)

/usr/local

• configure target for a make install of locally built software unless --prefix option is changed
• /usr/local/sbin: Locally compiled (installed) system programs
• /usr/local/etc: Host-specific system configuration for local binaries
• /usr/local/games: Local game binaries
• /usr/local/include: Local C header files
• /usr/local/src: Local source code
• /usr/local/lib: Local libraries
• /usr/local/lib<qual>: Local library variants
• /usr/local/man: Local online manuals
• /usr/local/share: Local architecture-independent hierarchy

/usr/share

• /usr/share/doc: Miscellaneous documentation
• /usr/share/man
• /usr/share/icons
• /usr/share/fonts
• /usr/share/color
  • /usr/share/color/icc: ICC color profiles
• /usr/share/dict: Word lists, used by spell checkers
• /usr/share/locale: Locale information
• /usr/share/zoneinfo: Timezone information and configuration
• /usr/share/info: Primary directory for GNU Info system
• /usr/share/misc
  • /usr/share/misc/magic.mgc: used by file command

/usr/share/man

• Online man pages: https://man7.org/linux/man-pages/index.html
• man1: User programs
• man2: System calls
• man3: Library functions and subroutines
• man4: Special files like /dev
• man5: File formats
• man6: Games
• man7: Miscellaneous
• man8: System administration Programs

# see man page of netstat
man netstat
 
# bind(2): see section 2 of bind
man 2 bind
 
# see man page of man
man man

Multiple man pages

• https://stackoverflow.com/questions/36789974/what-is-the-difference-between-multiple-man-pages-of-the-same-command
• socket(2) --- System call
• socket(3) --- POSIX interface
• socket(7) --- General topics on sockets

XDG Base Directory Spec

• https://specifications.freedesktop.org/basedir/latest/
• It defines where applications should store user-specific files

~/.config/  
├── git/  
├── nvim/  
└── app/  
  
~/.cache/  
├── browser/  
└── app/  
  
~/.local/share/  
├── fonts/  
└── app/

Variable	Purpose	Default value
XDG_CONFIG_HOME	User configuration files	~/.config
XDG_DATA_HOME	User application data	~/.local/share
XDG_CACHE_HOME	Non-essential cached files	~/.cache
XDG_STATE_HOME	Persistent state data	~/.local/state
XDG_RUNTIME_DIR	Temporary runtime files	/run/user/<uid>