Filesystem Layout
On Linux everything is a file — including devices, network sockets, and process info. Knowing the filesystem layout, the permission model, and the difference between hard and symbolic links makes every other shell skill make sense.
FHS, paths, permissions, links
EXAMPLE
# 1) Filesystem Hierarchy Standard (FHS) — the major directories # / root of the tree # /bin essential user binaries (ls, cp, mv) — often → /usr/bin # /sbin essential system binaries — often → /usr/sbin # /etc system-wide configuration files # /home user home directories (you live here) # /root home for the root user # /var variable data — logs, mail spools, caches # /tmp temporary files (often cleared on reboot) # /usr installed software (binaries, libs, headers) # /opt large/standalone third-party software # /proc virtual filesystem — kernel + process info # /sys virtual filesystem — kernel/devices # /dev device files (/dev/null, /dev/sda, /dev/tty) # /mnt /media mount points for removable drives # 2) Pwd and home pwd # /home/mara/project echo "$HOME" # /home/mara cd ~ # = cd "$HOME" cd - # back to previous directory # 3) Absolute vs relative paths ls /etc/nginx/nginx.conf # absolute — starts with / ls etc/nginx/nginx.conf # relative — interpreted from cwd ls ./script.sh # explicit 'here' ls ../sibling/file # parent then sibling ls ~/projects # home-relative # 4) Show what's in a directory ls -la # long + hidden (dotfiles) ls -lh # human-readable sizes ls -lt # sorted by mtime, newest first ls -1 # one entry per line (scripts) tree -L 2 -a # 2-level tree # Replacements bat /etc/nginx/nginx.conf # cat with syntax highlight exa -la # ls with icons + git status fd 'pattern' # find replacement # 5) Hidden files ls -d .* # all dotfiles in current dir # Anything starting with a dot is just convention — not protected. # 6) Permissions — rwx for owner / group / other ls -l # -rw-r--r-- 1 mara mara 1234 Aug 15 09:00 notes.md # ^^^ ^^^ ^^^ # user grp other # Numeric (octal) # r=4, w=2, x=1 # 755 = rwxr-xr-x (typical executable / script) # 644 = rw-r--r-- (typical file) # 600 = rw------- (private — SSH keys) # 700 = rwx------ (private dir — ~/.ssh) chmod 755 deploy.sh chmod u+x deploy.sh # add execute for owner chmod -R go-w shared/ # remove write for group + other recursively chmod 600 ~/.ssh/id_ed25519 # keys MUST be 600 or ssh refuses to use them # Ownership chown mara:mara notes.md chown -R deploy:www /srv/www # 7) Setuid / setgid / sticky bit ls -l /usr/bin/passwd # -rwsr-xr-x — the 's' in user-execute spot = setuid — runs as the file's owner # Sticky bit on /tmp — only the FILE'S owner can delete it (or root) ls -ld /tmp # drwxrwxrwt — the 't' chmod +t /shared/upload # 8) umask — default permissions for newly created files umask # 0022 # new file: 666 - 022 = 644 # new dir: 777 - 022 = 755 umask 077 # private by default # 9) Hard links vs symbolic links # Hard link: another name for the same inode (same data, same permissions, same size) ln source.txt hardlink.txt ls -li source.txt hardlink.txt # SAME inode number — they ARE the same file # Delete one, the other still exists; only when ALL hard links are gone does the data go. # Can't span filesystems; can't link directories. # Symbolic link: a tiny file containing a path ln -s /var/log/nginx/access.log ./access.log ls -l access.log # access.log -> /var/log/nginx/access.log readlink access.log # /var/log/nginx/access.log readlink -f access.log # canonical absolute path, resolved # Symlinks can span filesystems, can point to dirs, can dangle (point to nothing). # 10) Sizes and disk usage du -sh ~/Downloads # total size of a dir du -sh */ # size of each subdir, sorted du -h --max-depth=1 / 2>/dev/null | sort -hr | head -20 df -h # filesystem usage by mount point stat notes.md # full metadata: inode, size, atime/mtime/ctime # 11) Find files find . -type f -name '*.log' -mtime -7 # files modified in last 7 days find . -type f -size +100M # bigger than 100 MB find . -type d -empty # empty directories find . -name '*.bak' -delete # delete matches (use --dry-run alternatives first) # Modern alternative: fd fd -e log --changed-within 7d # 12) Where is something installed? which python3 # /usr/bin/python3 — first match on PATH type -a ls # ls is aliased to ... + /usr/bin/ls command -v node # POSIX equivalent of 'which' # 13) Mounts mount # list active mounts mount /dev/sdb1 /mnt/usb umount /mnt/usb lsblk # block device tree findmnt --target / # what mounts the path I care about # 14) /proc and /sys — kernel filesystems cat /proc/cpuinfo # CPU details cat /proc/meminfo # memory stats ls /proc/$$ # everything about the current shell process cat /proc/$$/status # state, parent, memory ls /sys/class/net # network interfaces # 15) Common bugs # • Editing config in /opt with a non-root user → permission denied; use sudo deliberately # • Symlink with relative target moves and breaks → prefer absolute targets for cross-tree links # • Forgetting -p in 'mkdir -p path/to/nested' → 'no such file or directory' on parent # • SSH keys at 0644 → 'WARNING: UNPROTECTED PRIVATE KEY FILE' → chmod 600 # • du run from / without permissions → noisy errors; redirect 2>/dev/null # • df vs du discrepancy → deleted-but-open files; restart the holder process
Why it matters
Permissions in octal stop being scary once you see rwx as 4+2+1: 644 is “owner read+write, everyone else read”. Symlinks are tiny path pointers, hard links are extra names for the same inode — backups and editors handle them very differently, so know which you’re creating.
Tip: Tweak the snippet with Try it Yourself », then sit the quiz at the bottom of the page.
Example
Example
# /bin /etc /home /opt /tmp /var /usr — the Filesystem Hierarchy Standard.Try it Yourself »
Discussion
Loading…