Repository navigation
EN_Linux_Basics
Question: Explain the basic concepts of the Linux operating system, and describe what a monolithic kernel architecture is by comparing it with a microkernel. Include the five main roles of the Linux kernel and its main components.
Answer:
Linux is a Unix-clone operating system developed by Linus Torvalds in 1991.
The kernel manages hardware resources, runs processes efficiently, and provides the essential services that applications depend on.
The five main roles of the Linux kernel:
-
Process Management
- CPU scheduling and process creation/termination
- Uses CFS (Completely Fair Scheduler)
-
Memory Management
- Virtual memory, paging, swapping
- Gives each process its own independent address space
-
Device Management
- Controls hardware through device drivers
- Exposes device files under the /dev/ directory
-
File System Management
- Supports many file systems through the VFS
- ext4, XFS, Btrfs, and more
-
Network Stack
- Implements the TCP/IP protocols
- Manages network interfaces
Main components of the Linux kernel:
- System call interface: the entry point through which user-space applications request kernel functions
- Kernel modules: code that can be loaded dynamically into the running kernel (device drivers, file system drivers)
- Inter-process communication (IPC): pipes, message queues, shared memory, and more
- Security and access control: SELinux, AppArmor, and more
A monolithic kernel runs every core service (process scheduling, memory management, file systems, device drivers, and the network stack) in kernel space, inside a single address space. Components talk to each other through direct function calls, so the overhead is low.
A microkernel keeps only the minimum in kernel space (IPC, basic scheduling, and address space management) and runs device drivers, file systems, and the network stack as server processes in user space. Components communicate by message passing (IPC). Well-known examples are MINIX 3, QNX, and seL4.
Linux is a monolithic kernel.
It does support loadable kernel modules (LKMs), so drivers and file systems can be loaded and unloaded with modprobe without a reboot.
Modules still run in kernel space, however, so a single buggy driver can still bring down the whole kernel (kernel panic).
| Aspect | Monolithic Kernel | Microkernel |
|---|---|---|
| Runs in kernel space | Scheduler, memory, file systems, drivers, network stack | Only IPC, basic scheduling, address space management |
| Inter-component communication | Function calls (fast) | IPC message passing (context-switch cost) |
| Performance | High | Relatively lower |
| Isolation and stability | A driver fault can take down the whole kernel | A driver fault stays inside its server process, which can be restarted |
| Code size | Large kernel code base | Small kernel, easier to verify (seL4 is formally verified) |
| Examples | Linux, FreeBSD | MINIX 3, QNX, seL4 |
The CPU enforces privilege levels for running code in hardware. On x86 these are called rings: ring 0 is the most privileged and ring 3 the least. Linux uses only two of them, ring 0 and ring 3 (on ARM64, EL1 and EL0 play the same roles).
- Kernel space: runs in ring 0. The core kernel, kernel modules, and device drivers live here and can access all memory and privileged instructions.
- User space: runs in ring 3. Applications such as shells, web servers, and databases, along with libraries like glibc, live here and cannot touch hardware or another process's memory directly.
User programs can reach kernel functions only through system calls.
For example, when a program calls read(), the glibc wrapper places the system call number and arguments in registers and executes the syscall instruction (x86_64).
The CPU switches to ring 0 and enters the kernel's system call handler; the kernel validates the arguments, reads the data through the VFS and the file system driver, and copies it into the user buffer.
When the work is done, sysret returns to ring 3.
You can watch which system calls a process makes with strace.
The split exists for stability and security. If a user program dereferences a bad pointer, only that process dies with a segmentation fault, while the kernel and every other process keep running. The kernel also enforces file permission checks and resource allocation, so an ordinary process cannot bypass them. As shown above, Linux is a monolithic kernel whose drivers also run in kernel space, so this protection does not cover driver bugs.
| Aspect | User Space | Kernel Space |
|---|---|---|
| CPU privilege level | Ring 3 (x86), EL0 (ARM64) | Ring 0 (x86), EL1 (ARM64) |
| What runs there | Applications, libraries (glibc, etc.) | Core kernel, kernel modules, device drivers |
| Hardware and memory access | Not direct; requested from the kernel via system calls | Direct |
| Address space | Separate per process | Kernel region shared by all processes |
| Impact of a fault | Only that process dies (segmentation fault) | Can halt the whole system (kernel panic) |
Question: Compare Red Hat-based (RHEL, CentOS, Fedora) and Debian-based (Debian, Ubuntu) distributions in terms of package manager, release policy, and commercial support.
Answer:
| Feature | Red Hat-based | Debian-based |
|---|---|---|
| Package Manager |
yum / dnf
|
apt |
| Package Format | RPM | DEB |
| Release Cycle | RHEL: 3 years, Fedora: 6 months | Debian: 2 years, Ubuntu LTS: 2 years |
| Support Period | RHEL: 10 years | Ubuntu LTS: 5 years |
| Init System | systemd | systemd |
| Legacy Service Commands |
service, chkconfig (RHEL 6 and earlier) |
service, update-rc.d (Debian 7, Ubuntu 14.10 and earlier) |
| Current Service Command | systemctl |
systemctl |
| Network Configuration Tool | NetworkManager (nmcli) |
Ubuntu: netplan, Debian: ifupdown |
| Security Module | SELinux | AppArmor |
| Firewall | firewalld | ufw |
| Commercial Support | Official Red Hat support | Canonical (Ubuntu) |
| Supported Architectures | x86_64, aarch64, IBM Power (ppc64le), IBM Z (s390x) | Broad official set: amd64, arm64, armhf, ppc64el, s390x, and more |
| Security Updates | Delivered by Red Hat to subscribers | Debian Security Team (Debian), Ubuntu Security Team (Ubuntu) |
| Community | Fedora is the community-driven proving ground that feeds RHEL | Debian itself is entirely community-driven |
Both families run systemd today, so the service control command is the same: systemctl.
Before systemd, SysV init scripts under /etc/init.d/ were controlled with service, and RHEL 6 and Ubuntu 9.10 to 14.10 used Upstart.
The service command still exists as a compatibility wrapper that calls systemctl.
The differences show up mainly in package names and configuration file locations.
| Item | Red Hat-based | Debian-based |
|---|---|---|
| Service default options file | /etc/sysconfig/<service> |
/etc/default/<service> |
| Network interface configuration |
/etc/sysconfig/network-scripts/ifcfg-* (legacy), /etc/NetworkManager/system-connections/
|
/etc/network/interfaces (Debian), /etc/netplan/*.yaml (Ubuntu) |
| Apache package and service name | httpd |
apache2 |
| Apache configuration directory | /etc/httpd/ |
/etc/apache2/ |
| System log | /var/log/messages |
/var/log/syslog |
| Authentication log | /var/log/secure |
/var/log/auth.log |
Starting with RHEL 9, the ifcfg format is deprecated and NetworkManager's keyfile format (.nmconnection) is the default.
Ubuntu's netplan reads YAML configuration and renders it into configuration for systemd-networkd or NetworkManager.
Starting with Debian 12, rsyslog is no longer installed by default, so logs are read with journalctl instead of /var/log/syslog.
| Action | Red Hat (YUM/DNF) | Debian (APT) |
|---|---|---|
| Install a package | sudo dnf install nginx |
sudo apt install nginx |
| Remove a package | sudo dnf remove nginx |
sudo apt remove nginx |
| Search for a package | dnf search nginx |
apt search nginx |
| System update | sudo dnf upgrade |
sudo apt update && sudo apt upgrade |
| Clean up the cache | sudo dnf clean all |
sudo apt clean |
| Refresh the package index | sudo dnf check-update |
sudo apt update |
| Add a repository | sudo dnf config-manager --add-repo <repo-url> |
sudo add-apt-repository '<deb-line>' |
| List installed packages |
dnf list installed / rpm -qa
|
apt list --installed |
| Find the package that provides a file | dnf provides /usr/sbin/nginx |
apt-file search /usr/sbin/nginx |
| Remove unused dependencies | sudo dnf autoremove |
sudo apt autoremove |
| Show package details | dnf info nginx |
apt show nginx |
| Check for broken dependencies | dnf check |
sudo apt-get check |
apt-file is not installed by default: install it with sudo apt install apt-file and build its index with sudo apt-file update first.
On older RHEL/CentOS releases, replace dnf with yum (dnf config-manager comes from the dnf-plugins-core package, yum-config-manager from yum-utils).