Linux — the base of the system
Łukasz Gołek · WIMiC AGH
The most important thing is that you understand how your system works — the rest will come with time. Linux is a very simple and logical system once you understand the basics.
In the bootloader, select the language you want to use for the boot process.
Select the desired entry and press E to edit. At the end of the kernel line, add 3 to boot into runlevel 3 (multi-user, no GUI).
Ctrl+X or F10 to boot with the modified parameters.
aghos as login (no password required initially) → you are now in the terminal.
Login as: aghos (without password) sudo su # become root passwd aghos # set a temporary password
Switches to another user account. Requires the target user's password. Starts a new shell as that user.
Executes a single command with elevated privileges. Requires the current user's password. Controlled via /etc/sudoers.
Runs su as root using sudo. Gives you a root shell without requiring the root password.
Change your own password. sudo passwd john — change password for another user as superuser.
SSH allows you to use proper copy/paste shortcuts in your host terminal instead of typing directly in VirtualBox.
systemctl start sshd # start SSH daemon inside VM ssh -p 2222 aghos@localhost # connect from host terminal
Or connect via PuTTY (Windows):
In Linux, this single character is the most important directory in the entire system — the root directory.
Everything starts here. Every file, every folder, every device lives somewhere under /.
Every user gets their own subdirectory: /home/aghos, /home/albert, /home/kasia…
When you log in as a regular user, this is your starting point.
The home directory of the root user. Intentionally separate from /home — even if /home is unavailable, root can still log in.
/ (root directory) = top of the entire filesystem treeroot user = the administrator account whose home is /rootEvery device — hard drive, USB stick, keyboard — has a corresponding file here. Linux treats hardware as files.
The "control panel" of the system. All configuration files for services, users, and programs live here.
Essential commands every user can run: ls, cp, mv, bash.
Each regular user gets their own folder. Movies, pictures, music, games — gigabytes per file, written once, read many times.
Short for "variable". Log files grow here, databases store data here, mail queues sit here — thousands of tiny writes all the time.
Everything needed to start the system: the kernel itself and bootloader configuration. Without this, the system won't start.
Where most installed programs and their libraries live. The "software" directory of the system.
Virtual filesystems. Don't exist on disk — provide real-time info about processes and hardware.
Temporary files. Cleared on reboot. Use tmpfs (RAM-backed) for best performance.
/home = many large files, rare writes.
/var = thousands of small files, very frequent changes.
Different workloads → different optimal filesystems.
File Allocation Table. Universal compatibility (USB drives, SD cards). FAT32: max 4 GB per file. exFAT: removes the 4 GB limit. No journaling, no Unix permissions.
Windows default since NT. Has journaling. Supports large files and permissions. Not ideal for Linux root partitions — but readable/writable on Linux.
In coming classes we'll cover Linux-native filesystems: ext4, XFS, Btrfs, and ZFS.
Short for devices. In Linux, everything is treated as a file — including hardware. Your hard drive, USB stick, keyboard, and terminal all appear as files in the system.
/devFirst serial drive (SATA or USB)
Partitions of the first serial drive
Partitions on the second serial drive
First video capture device (webcam). Second camera → video1
First mouse. Every movement, every click flows through this file as a stream of data.
Device type + number starting from zero. Numbers = "first found", "second found"…
read — read data from the devicewrite — send data to the deviceopen — open the device fileclose — release the device fileThe same cat, cp, or dd commands that work on text files also work on device files.
Want to clone an entire disk? dd if=/dev/sda of=disk.img
/dev/dev/sda, /dev/nvme0n1
Hard drives, SSDs, USB drives. Random access, data in chunks (blocks).
/dev/tty, /dev/snd
Terminals, sound cards. Sequential stream — one character at a time. No seeking.
/dev/eth0, /dev/enp0s3
Ethernet and wireless interfaces.
/dev/pts/0
Virtual terminals — used by SSH sessions, terminal emulators.
/dev/shm
RAM-backed shared memory for IPC.
/dev/input/
Keyboards, mice, joysticks, touchpads.
/dev/random, /dev/urandom
Random number generators. /dev/null — the black hole.
read (fd, buf, n) write (fd, buf, n) open (path, flags) close (fd) ioctl (fd, cmd)
Whether it's a file, a device, a socket, or a process — the same interface handles it all. No special cases.
HDD/SSD — random access storage
Terminal — sequential stream
Kernel data — generated on the fly
/dev/sda, /dev/nvme0n1, /dev/mmcblk0 — random access, buffered I/O
Process calls read(fd, buf, 4096) → VFS checks Page Cache → cache HIT: return from RAM instantly → cache MISS: goes to Block I/O Layer → disk driver.
Data is stored as numbered sectors. You can jump (lseek) to any block. No ordering requirement. That's the fundamental difference from character devices.
/dev/tty, /dev/urandom, /dev/input/event0 — sequential stream, no buffering, no seeking
Data is not buffered in RAM. Every read() goes directly to the driver. That is why reading from /dev/urandom is slower than reading from a file.
You cannot rewind the stream. Which makes sense — how would you un-receive bytes that already came from the keyboard?
/home/alice/etc, /usr, /binrm -rf /home/alice # wipes user + malware # system untouched useradd -m alice # fresh account, clean slate
Total remediation time: under 60 seconds.
| Linux | Windows |
|---|---|
| Malware contained in user directory | Drivers run in ring 0 — malware can escalate |
| rm -rf /home/alice removes everything | Registry survives user deletion — malware persists |
| No cross-process injection | COM/DLL injection across process boundaries |
| Clean in <60 seconds | Multi-hour forensic exercise |
| ✓ Linux | ⚠ Windows |
|---|---|
| Monolithic kernel with loadable modules | HAL (Hardware Abstraction Layer) — legacy since NT 3.1 |
| Direct hardware access via VFS | Win32 API compatibility layer on top of kernel |
| Drivers compiled or loaded as modules | Drivers run in ring 0 — one crash = BSOD |
| Clean separation: kernel space / user space | Registry: monolithic configuration database |
| POSIX standard — predictable interfaces | Decades of backward compat. shims |
| SELinux, AppArmor, namespaces, cgroups | Attack surface grows with every compat. layer |
| No backward compat. baggage from 1985 | Patching HAL often breaks legacy drivers |
The Win32/HAL/Registry architecture creates enormous switching costs. Cleaning up legacy would break millions of enterprise apps. Microsoft knows this and has no economic incentive to fix it.
Regular high-profile vulnerabilities (EternalBlue, PrintNightmare, MSHTML…) drive enterprise customers toward Microsoft's own security products: Defender, Sentinel, Entra ID. The problem and the solution are sold by the same vendor.
Deep HAL coupling means patching one subsystem risks breaking drivers, OEM hardware, or line-of-business apps. Microsoft can show "effort" while delivering limited actual reduction in attack surface.
/dev — Device File ReferenceThe directory /dev in Linux contains files responsible for communication between the computer and devices.
xterm aterm uxterm konsole yakuake kitty alacritty gnome-terminal
Use sudo for individual privileged commands. Running everything as root removes all the security boundaries we just discussed.
.hidden/etc/hosts — static hostname-to-IP mappings.sudo nano /etc/hosts to explore your first Linux config file.
Connecting a partition (like /dev/sda2) to a directory in the tree (like /mnt/gentoo). After mounting, you access the partition's contents through that directory.
mount /dev/sda2 /mnt/gentooumount /mnt/gentoo
Persistent mounts configured in /etc/fstab
If you have any questions — you know where to find me. See you in a week! 🙂