Linux › Section A · The big picture › Topic A.1
Linux, Unix, and levels of abstraction
A running Linux system holds hundreds of cooperating parts, yet it becomes easy to reason about once you sort them into a few layers. This topic sets out those layers and explains where Linux, its licence and its many distributions came from.
Seeing a system in layers
Nobody understands a modern operating system by studying every line of its code at once. Instead you use abstraction: you treat each part as a box with a job and an interface, and ignore its insides until you need them. When you send an email you think about the message, not the radio signals carrying it. Engineers group these boxes into layers, or levels, by how close each sits to the user or to the hardware. Each layer relies on the one below and offers simpler services to the one above.
The three main levels
A Linux system has three broad levels. At the bottom is the hardware: one or more processors (CPUs), main memory (RAM), and devices such as disks, network interfaces and screens. In the middle is the kernel, the core of the operating system. It lives in memory, decides which program the CPU runs next, hands out memory and operates the devices; every running program depends on it. At the top is user space: all the running programs, called processes, that the kernel manages. Shells, web servers and browsers all live here. The next topics, "Hardware: main memory and state" and "The kernel: processes, memory, drivers, and system calls", look at the lower two levels in turn.
Kernel mode and user mode
The kernel and user processes do not run with the same powers. The processor provides at least two privilege levels. The kernel runs in kernel mode, also called privileged mode, with unrestricted access to the processor and all of memory; the memory reserved for it is called kernel space. Processes run in user mode, which allows only safe instructions and only the memory the kernel has given them. This split is what keeps one fault from spreading. If a browser crashes, the kernel cleans up after it and other programs carry on. A bug in the kernel itself has no such safety net, which is why kernel code is reviewed so carefully.
Worked example: finding the layer at fault
A web server program on a Linux machine stops answering requests, but you can still log in over the network and run commands. Where is the fault? 1. Logging in remotely needs working network hardware, the kernel's network code and several user-space programs, so all three levels are basically healthy. 2. Your shell responds and other commands run, so the kernel is still scheduling processes. 3. That points to user space, and most likely to the web server process itself. 4. Check: restarting only that program restores the service. Had the whole machine stopped responding, even to the keyboard, you would have looked lower down, at the kernel or the hardware.
From Unix to GNU to Linux
Linux is a Unix-like system. Unix was created at Bell Labs from 1969 by Ken Thompson and Dennis Ritchie and largely rewritten in C in 1973, which made it portable to new machines. It popularised a single file tree, small tools joined by pipes and plain-text configuration; the University of California, Berkeley, produced the influential BSD variant. In 1983 Richard Stallman announced the GNU project to build a free Unix-like system, and by the early 1990s it had a compiler, a shell and core utilities but no finished kernel. In 1991 Linus Torvalds, a student in Finland, announced his own kernel, Linux. Combined with GNU tools it formed a complete free system, which is why some people say GNU/Linux.
Open source licences in outline
Linux has been licensed under the GNU General Public License (GPL), version 2, since 1992. The GPL is a copyleft licence: anyone may run, study, change and share the code, but if you distribute a modified version you must make its source available under the same licence. Permissive licences, such as the MIT and BSD licences, ask much less: you may use the code, even inside a closed commercial product, provided you keep the copyright and licence notice. FreeBSD, a descendant of BSD Unix, uses a BSD licence. Both kinds count as open source; they differ in whether the freedoms must be passed on. This is an outline, not legal advice.
Distributions and their families
Nobody installs a bare kernel. A distribution bundles the kernel with user-space software, a package manager, an installer and default settings. Most belong to a few families. The Debian family, including Debian itself and Ubuntu, uses .deb packages and the apt tool. The Red Hat family, including Fedora, Red Hat Enterprise Linux (RHEL), CentOS Stream and rebuilds such as Rocky Linux and AlmaLinux, uses .rpm packages and dnf. SUSE and openSUSE also use .rpm packages, with the zypper tool. Others stand alone: Arch Linux suits hands-on users, and the very small Alpine Linux is popular in containers. Skills transfer between families; mainly the package tools and some file locations differ.
Release models
Distributions also differ in how they release. A fixed-release, or point-release, distribution freezes a tested set of versions and then ships mainly security and bug fixes until the next release. Debian's stable release comes about every two years. Ubuntu releases every six months, and every two years one of these is a long-term support (LTS) release with five years of standard security updates; the others get about nine months. Fedora releases about every six months, and RHEL versions are supported for about ten years. A rolling-release distribution, such as Arch Linux or openSUSE Tumbleweed, has no big versions: packages update continuously.
Worked example: identifying a distribution
You log in to an unfamiliar server and run cat /etc/os-release. An illustrative result includes these lines: PRETTY_NAME="Ubuntu 24.04.1 LTS", VERSION_ID="24.04", ID=ubuntu and ID_LIKE=debian. 1. ID names the distribution: Ubuntu. 2. ID_LIKE lists related systems, here debian, so this is the Debian family and software comes as .deb packages through apt. 3. LTS marks a long-term support release with years of updates ahead. 4. A second server shows ID="centos" and ID_LIKE="rhel fedora": the Red Hat family, so use dnf and .rpm packages. Check: the kernel version is a separate fact; uname -r prints it.
Common mistakes to avoid
First, calling a distribution "the kernel": Ubuntu and Fedora are distributions that both contain the Linux kernel. Second, thinking user processes reach hardware directly; they run in user mode and must ask the kernel. Third, assuming copyleft forbids selling software; the GPL allows it but requires the source to go with any distributed version. Fourth, reading the distribution version from uname -r, which reports the kernel release instead. Fifth, assuming every distribution uses apt; the Red Hat family uses dnf. Sixth, treating Unix and Linux as the same code: Linux is a Unix-like system written independently.
Key takeaways
Abstraction lets you treat each part as a box with a job, arranged in layers. Linux has three levels: hardware, the kernel, and user space with its processes. The kernel runs in kernel mode with full access; processes run in restricted user mode, so their crashes stay contained. Unix (Bell Labs, 1969), GNU (1983) and Torvalds's kernel (1991) led to today's systems; Linux uses GPL version 2, a copyleft licence, while MIT and BSD licences are permissive. Distributions form families such as Debian (apt, .deb) and Red Hat (dnf, .rpm), with fixed or rolling releases. /etc/os-release identifies a distribution.
Flashcards
Flashcard
Treating a part as a box with a job and an interface, ignoring its insides
Test your understanding
Question 1 of 5
A buggy desktop app crashes, but your other programs keep running normally. Which feature of Linux mainly explains this?
Question 2 of 5
A server's /etc/os-release contains ID=ubuntu and ID_LIKE=debian. Which package tool and format should you expect?
Question 3 of 5
Which statement about the GNU General Public License is correct?
Question 4 of 5
A web server stops responding, yet you can log in remotely and run commands normally. Which layer is the most likely place to look first?
Question 5 of 5
Which describes a rolling-release distribution such as Arch Linux?