Page ↑ / Page ↓ to move · scroll works too
Linux & DevOps — Lecture 3 of 8
You can move around and reach the machine.
Today: how it’s organized, how software gets on it,
and who’s allowed to touch what.
Lecture 2 gave you the hands. This lecture gives you the map: where files are supposed to live, how packages arrive and get tracked, and the permission model that decides whether a command you just typed is even allowed to run. Every “permission denied” for the rest of this course traces back to something in today’s lecture.
Linux has a single root, /. There’s no C:\ — a second disk, a USB stick, or a remote share all get grafted onto the same tree at some directory, via mounting. Ask “what filesystem is this path on” with df, not by looking at the path itself.
/etc — system-wide configuration, almost always plain text/var — data that changes at runtime: logs, spool queues, caches/home — personal directories, one per user/opt — self-contained third-party software, one directory per app/usr — the OS itself: binaries, libraries, shared data/tmp — temporary files, cleared on a schedule or at reboot/proc and /sys — not real files, a live window into the kernelThe FHS is a convention, not a law enforced by the kernel — but every RPM package, every systemd unit, and every other admin on the planet assumes you’re following it. Put your own app under /opt, not scattered across the tree.
which finds it on $PATH, whereis also finds the man page and source. file tells you what a file actually is, not what its extension claims. stat shows size, timestamps, permissions, and ownership in one shot.A manual mount doesn’t survive reboot — a line in /etc/fstab is what makes it permanent. This isn’t a full storage lecture; you need just enough to answer “what’s mounted where” when something runs out of space.
A .rpm isn’t just files to copy — it declares what it depends on, where each file goes, and how to cleanly remove itself later. The package manager tracks all of that in a database, so “what’s installed” and “can I safely remove this” are answerable questions instead of guesses.
dnf resolves and installs dependencies automatically, and dnf history gives you an undo log — dnf history undo <id> reverses a specific transaction if an update goes wrong.Each file in /etc/yum.repos.d/ points at a repository URL. RHEL’s own repos require an active subscription; EPEL (“Extra Packages for Enterprise Linux”) is the most common add-on repo for software Red Hat doesn’t ship directly.
dnf calls rpm under the hood — reach for rpm directly when you already know the package name and just want facts about it, no network required. subscription-manager is what grants access to RHEL's own repositories in the first place.There’s no process without an owner. That owner — a UID, resolved to a username — is what permission checks are made against. root is UID 0 and bypasses most of those checks entirely, which is exactly why you don’t operate as root by default.
/etc/passwd is world-readable and holds identity, not secrets — the x means the real password hash lives in /etc/shadow, readable only by root. /etc/group maps group names to members.-m creates the home directory, -aG appends to supplementary groups — leaving off -a replaces the user's whole group list, a classic way to accidentally lock someone out of their own groups./etc/passwdusermod -g/etc/groupusermod -aGwheel is the supplementary group that traditionally grants sudo access on RHEL-family systems — membership in it is a permission grant, not a change of identity.Position one is file type; the next nine split into three groups of rwx — owner, group, everyone else. On passwd, the s in place of owner-execute is the setuid bit: it runs as root no matter who invokes it, which is exactly how an unprivileged user is allowed to change their own password.
4 read, 2 write, 1 execute, summed per scope — 7=rwx, 5=r-x644 is the standard file default, 755 the standard executable/directory defaultOnly root can hand a file to a different owner; any owner can change the file’s group, as long as they belong to the target group themselves.
New files start from 666, new directories from 777, and umask subtracts bits from that default — 022 is why a freshly created file lands at 644 instead of 666. Set it in a shell startup file to change the default for every new file a user creates.
When owner/group/other isn't granular enough, and when root shouldn't mean everyone.
Standard permissions can grant exactly one owner and one group. The moment you need “these three specific people, plus the group, each with different access” — a shared team directory being the classic case — chmod alone can’t express it. That’s what ACLs (Access Control Lists) are for.
-m modifies an entry, -d sets a default ACL a directory applies to everything created inside it afterward, -x removes an entry. A + after the mode in ls -l output (rwxr-x---+) is the tell that a file has ACL entries beyond the basic three.Every sudo invocation is logged to /var/log/secure — who ran what, as whom, and when. Always edit sudo rules with visudo, never a text editor directly: it validates syntax before saving, so a typo can’t lock every admin out of sudo at once.
%groupname; user rules use the bare username/etc/sudoers.d/ instead of editing the main file — easier to review and to revert