The Linux Filesystem

Updated: December 31, 2020
Published: September 10, 2020

Linux Administrator

All around security geek, editor-in-chief and janitor.

Share This Post:

The Linux filesystem structure is somewhat different from that of Windows in that Linux doesn’t make use of a physical drive, such as the C: drive, as the base of the filesystem but rather, uses a logical filesystem .

Logical vs Physical Files

Before diving into the details of the filesystem structures, it is important to draw a distinction between logical and physical files, as it is essential to understanding linux.

Logical Filesystems

Logical files do not contain data. They contain descriptions of records that are found in one or more physical files.

It does not occupy memory space.
It does not contain data.
It can contain up to 32 record formats.
It cannot exist without physical file.
If there is a logical file for a physical file, the logical file can be deleted without deleting the physical file.
CRTLF command is used to make such object.

Physical Filesystems

Physical files contain the actual data , in only one record format, as well as a description of how data is to be presented to or received from a program. Best understood as a collection of bytes on a disk.

It occupies the portion of memory;
It contains the original data;
It can exist without logical file;
If there is a logical file for physical file, the physical file cannot be deleted until and unless we delete the logical file; and
CRTPF command is used to make such object.

Linux Filesystem Structure

Probably the best way to understand the Linux filesystem is to explore it through the terminal window in order to see the map of Linux’s directory tree.
Install tree by doing the following on Ubuntu:

Apt-get install tree

Now open a terminal and run tree :

tree -L 1/

The command above instructs the terminal to “show only the 1st Level of the directory tree starting at / (root)“. The “-L” option tells tree how many levels down you want to see.

The top of the file- system structure is “ / ”, which is the root of the filesystem and is different from the root user and the following, from top to bottom, are the most important subdirectories to know:

/bin

Where application binaries, the equivalent of executable files, reside. These are the programs you can run as well as other basic tools for making and removing files and directories, moving them around, and so on. There are more bin directories in other parts of the file system tree.

/boot

The /boot directory contains files required for starting your system. If you mess up one of the files in here, you may not be able to run your Linux.

/dev

/dev contains device files which are generated at boot up or run time. When you add a new webcam or a USB to your machine, a new device entry shows up here.

/etc

/etc contains system-wide configuration files that you should avoid tinkering with unless you know what you are doing. The contents of this folder include:

Files that contain the name of your system;
Users and their passwords;
The names of machines on your network; and
When and where the partitions on your hard disks should be mounted.

/home

/home is where you will find your users’ personal directories.

/lib

/lib is where you find libraries, which are shared programs similar to Windows DLLs. Libraries are files containing snippets of code that applications use:

To draw windows on your desktop;
Control peripherals; or,
Send files to your hard disk.

Additional lib directories EW scattered around the filesystem, but the one directly off of “/” contains the all-important kernel modules, drivers that make things like your video card, sound card, WiFi, printer, and so on, work.

/media

The /media directory is where external storage will be automatically mounted when you plug it in and try to access it.

/mnt

The /mnt directory, where other filesystems are attached or mounted to the filesystem however, is a bit of remnant from days gone by. This is where you would manually mount storage devices or partitions. It is not used very often.

/opt

The /opt directory is often where compiled software resides, usually binaries are in the in the /opt/bin directory and libraries in the /opt/lib directory.

/proc

/proc is a virtual directory and contains information about your computer, such as information about your CPU and the kernel your Linux system is running and are generated when your computer starts, or on the fly, as your system is running and things change.

/root

/root is the home directory of the superuser of the system. It is separate from the rest of the users’ home directories BECAUSE YOU ARE NOT MEANT TO TOUCH IT.

/run

Do not touch the /run directory. System processes use it to store temporary data.

/sbin

/sbin is similar to /bin, but it contains applications that only the superuser will need. These applications can be used by regular uses with the sudo command that temporarily concedes you superuser powers on many distributions. This folder contains tools that can install, delete and format files.

/usr

/usr contains directories which in turn contain applications, libraries, documentation, wallpapers, icons and a long list of other stuff that need to be shared by applications and services. Additionally, there are bin, sbin and lib directories in /usr. Most Linux distributions just put all the programs into /usr/bin and have /bin point to /usr/bin.

/srv

The /srv directory contains data for servers. If you are running a web server from your Linux box, your HTML files for your sites would go into /srv/http (or /srv/www). If you were running an FTP server, your files would go into /srv/ftp.

/sys

/sys is another virtual directory like /proc and /dev and also contains information from devices connected to your computer.

/tmp

/tmp contains temporary files, usually generated by applications that you are running. The files and directories often (not always) contain data that an application doesn’t need right now, but may need later on. /tmp can also store your own temporary files and is one of the few directories hanging off “/” that you can interact with without becoming superuser.

/var

/var was originally given its name because its contents was deemed variable, in that it changed frequently. /var contains things like logs in the /var/log subdirectories. Logs are files that register events that happen on the system. If something fails in the kernel, it will be logged in a file in /var/log; if someone tries to break into your computer from outside, your firewall will also log the attempt here. It also contains spools for tasks. These “tasks” can be the jobs you send to a shared printer when you have to wait because another user is printing a long document, or mail that is waiting to be delivered to users on the system.