Linux File System Hunting
Linux is often introduced through commands like ls, cd, or mkdir. But the real power of Linux is hidden deeper inside its filesystem. Linux treats almost everything as a file, including devices, processes, networking information, logs, and even kernel behavior.
For this exploration, I investigated important Linux directories and configuration files to understand how the operating system manages networking, permissions, services, devices, users, and processes internally.
This was not just about running commands. It was about understanding why these files exist and how Linux organizes the entire system through the filesystem itself.
1. /etc — The Brain of System Configuration
The /etc directory stores most system-wide configuration files.
When Linux boots, services and applications read configuration files from /etc to decide how the system should behave.
Some important files inside /etc:
/etc/hostname
/etc/hosts
/etc/resolv.conf
/etc/passwd
/etc/shadow
What I Learned
Linux separates configuration from application binaries. Programs are stored elsewhere, but their behavior is controlled from /etc.
For example:
/etc/hostnamestores the machine name/etc/hostsmaps local domain names to IP addresses/etc/resolv.confcontrols DNS resolution/etc/passwdstores user account information
This design makes Linux highly customizable and easy to administer.
Why It Matters
Instead of changing application code, administrators can modify behavior simply by editing configuration files.
This separation is one reason Linux servers are extremely flexible and powerful.
2. DNS Resolution Inside /etc/resolv.conf
One of the most interesting discoveries was how Linux handles DNS lookups.
The file:
/etc/resolv.conf
contains DNS server information.
Example:
nameserver 8.8.8.8
This tells the system where to send DNS queries.
What Problem It Solves
Humans use domain names like:
google.com
But systems communicate using IP addresses.
DNS converts human-readable names into IP addresses.
Interesting Insight
I realized that internet access depends heavily on this file. If DNS breaks, websites stop opening even if the internet connection still exists.
This file acts like the “phonebook connector” between Linux and the internet.
3. /proc — The Live Window Into the Kernel
The /proc directory was one of the most fascinating discoveries.
Unlike normal directories, /proc is a virtual filesystem generated directly by the Linux kernel.
It does not permanently store files on disk.
Instead, it provides real-time system information.
Examples:
/proc/cpuinfo
/proc/meminfo
/proc/version
/proc/[PID]
What I Learned
Every running process gets its own directory inside /proc.
For example:
/proc/1
contains information about process ID 1.
Inside each process folder:
memory details
environment variables
open file descriptors
process status
command-line arguments
can all be inspected.
Why It Matters
Linux exposes internal kernel data through files instead of complicated APIs.
This makes monitoring tools possible.
Commands like:
top
ps
free
actually read information from /proc.
Most Interesting Insight
Processes in Linux are deeply connected to the filesystem itself.
Linux turns system internals into readable files.
That design philosophy is incredibly elegant.
4. User Management Through /etc/passwd and /etc/shadow
Linux user management is controlled through text files.
/etc/passwd
Contains:
username
user ID
home directory
login shell
Example:
dipanshu:x:1000:1000::/home/dipanshu:/bin/bash
/etc/shadow
Stores encrypted passwords and password policies.
Only root can access it.
What Problem It Solves
Linux separates public user information from sensitive authentication data.
This improves security.
Interesting Insight
Even though Linux is extremely advanced, many critical system components are still managed using simple text files.
That simplicity is part of Linux’s strength.
5. Device Handling Inside /dev
Linux treats hardware devices as files.
The /dev directory contains device files for:
disks
USB drives
terminals
keyboards
random number generators
Examples:
/dev/sda
/dev/null
/dev/random
/dev/tty
What I Learned
Programs interact with hardware through these device files.
For example:
/dev/null
acts like a “black hole” where discarded output goes.
Why It Matters
Linux provides a unified interface.
Applications do not need to know low-level hardware implementation details.
Everything behaves like a file.
Most Interesting Discovery
Even random number generation is exposed as a file:
/dev/random
That perfectly demonstrates Linux’s philosophy:
“Everything is a file.”
6. System Logs Inside /var/log
Linux continuously records system activity in log files.
Important logs:
/var/log/syslog
/var/log/auth.log
/var/log/kern.log
What Problem It Solves
Logs help administrators:
debug errors
detect attacks
analyze crashes
monitor services
What I Learned
Linux systems constantly generate diagnostic information.
For example:
failed login attempts
SSH activity
kernel messages
service failures
are all recorded.
Interesting Insight
Modern observability systems used in cloud computing are built on the same principle as Linux logs.
Logs are essential for understanding system behavior.
7. Process Investigation Through /proc/[PID]
Every process in Linux exposes detailed information through its process directory.
Example:
/proc/2345/status
/proc/2345/environ
/proc/2345/fd
What I Learned
The /fd folder contains file descriptors used by the process.
This includes:
open files
sockets
pipes
terminals
Why It Matters
This makes Linux extremely transparent.
Administrators can inspect what a process is doing in real time.
Interesting Discovery
Network sockets are also represented as file descriptors.
This means networking in Linux is deeply integrated with the filesystem model.
8. Boot Files Inside /boot
The /boot directory contains files required during startup.
Important files:
vmlinuz
initrd
grub
What They Do
vmlinuz→ compressed Linux kernelinitrd→ temporary filesystem loaded during bootgrub→ bootloader configuration
What I Learned
The boot process is modular.
Linux loads:
Bootloader
Kernel
Initial RAM filesystem
Real root filesystem
Why It Matters
This modular startup process allows Linux to support many hardware environments and recovery mechanisms.
9. Service Management Through systemd
Modern Linux distributions use systemd for managing services.
Configuration files are often found in:
/etc/systemd
/lib/systemd
Example service:
sshd.service
What Problem It Solves
Linux systems run many background services:
SSH
networking
databases
web servers
systemd manages their startup, restart behavior, dependencies, and monitoring.
Interesting Insight
A Linux system is essentially a collection of services coordinated together.
systemd acts like a central service orchestrator.
10. Network Information and Routing Tables
Linux stores networking information in multiple places.
Useful exploration areas:
/proc/net/
/etc/network/
/sys/class/net/
What I Learned
Routing tables determine where packets travel.
Linux networking is extremely transparent because interfaces, routes, and socket information can all be inspected through filesystem entries.
Interesting Discovery
Even network statistics are readable through files.
Linux exposes networking internals openly instead of hiding them.
11. Permission Structure and Security
Linux permissions are one of its strongest security features.
Each file has:
owner
group
permission bits
Example:
-rwxr-x---
What I Learned
Permissions control:
who can read
who can modify
who can execute
Special permissions like:
SUID
SGID
sticky bit
provide advanced privilege behavior.
Why It Matters
Linux security is strongly tied to the filesystem.
A misconfigured permission can become a major security vulnerability.
12. Environment Variables and Shell Behavior
Shell configuration files include:
~/.bashrc
~/.profile
/etc/profile
What They Do
These files configure:
environment variables
aliases
startup behavior
PATH settings
Interesting Insight
The Linux shell is highly customizable because startup behavior itself is file-driven.
The terminal experience changes depending on these configuration files.