Linux Operating System: Kernel, Processes, Files and Worked Examples

Linux becomes easier to reason about once each layer has a separate job. The kernel manages privileged resources, the shell launches programs, and a distribution packages the user-space system. Follow those connections through a system-call trace, virtual-address translation, permission arithmetic and a two-pipe command.

Linux, the Kernel, a Distribution and the Shell

Linux is the kernel, the privileged software that manages processes, memory, devices, file systems and networking. A distribution packages that kernel with user-space libraries, tools, a package system and configuration choices. Ubuntu, Fedora and Debian are distributions, not synonyms for Linux. A shell such as Bash is a user-space command interpreter.

The stack runs from hardware to the kernel, through the system-call interface, then to libraries, daemons, shells and graphical applications. Linux is monolithic with loadable modules: core operating-system services run in kernel space, but every possible driver need not be permanently built into one binary in practice. For the broader preparation route, use the GATE CS exam preparation category.

From a User Program to the Kernel: One System-Call Trace

Trace a process reading one complete file. PID 4121 has descriptors 0, 1 and 2 open. The example ext4 file /home/asha/note.txt contains exactly 3000 bytes, descriptor 3 is free, and every write succeeds fully.

1. openat(AT_FDCWD, "/home/asha/note.txt", O_RDONLY) returns 3.

2. read(3, buf, 4096) returns 3000.

3. write(1, buf, 3000) returns 3000.

4. A second read(3, buf, 4096) returns 0, meaning end of file.

5. close(3) returns 0.

Descriptor 3 is a per-process handle, not the file itself. Each call crosses a controlled user-to-kernel boundary. The Virtual File System routes this example to ext4. Data already in the page cache need not be read from the storage device.

Processes, Threads, States and Scheduling

A program is executable code and data. A process is a running instance with a PID and virtual address space. Threads are execution flows with thread IDs and individual execution state, but they share their process's address space and resources.

The scheduler chooses among runnable tasks. A blocked task waits for an event. A context switch saves one task's state and restores another's. In ps, R means running or runnable, S interruptible sleep, D uninterruptible sleep, T stopped and Z zombie.

Shell PID 4100 calls fork(). The parent receives child PID 4121, while the child receives 0. Child 4121 calls execve(), replacing its program image without creating a process. It exits with status 0; parent 4100 calls waitpid(4121, ...) and reaps it. A zombie is an exited process awaiting collection, not running work. ps, top and /proc/4121 reveal this state.

Virtual Memory, Pages, the TLB and a Worked Translation

Processes use virtual addresses. The memory-management unit translates them through page tables, while the translation lookaside buffer (TLB) caches recent translations. Demand paging can raise a valid page fault for a non-resident page. That differs from an invalid access. Swap can hold anonymous pages, while the file-backed page cache holds file data. A page fault is not automatically a crash.

With page size 4096 bytes = 0x1000 and virtual address 0x12345, a 4 KiB page uses 12 offset bits. The virtual page number is 0x12 and the offset is 0x345, or decimal page 18 and offset 837.

If the page table maps virtual page 0x12 to physical frame 0x2A, or decimal 42, preserve the offset:

physical address = (0x2A x 0x1000) + 0x345 = 0x2A345

The decimal check is 42 x 4096 + 837 = 172,032 + 837 = 172,869. Derive the offset bits, split the address, look up the frame and preserve the offset. A TLB miss can still find a valid page-table entry in memory, so it is not the same as a page fault.

Linux File Systems, Inodes and Permission Arithmetic

The Virtual File System provides one interface across file systems, while a mount point attaches a file system within the directory tree. A directory maps names to inode references through directory entries, or dentries. The inode stores metadata and file-data references, but not the ordinary directory-entry name.

A file descriptor is a process-local handle to an open object. A hard link is another entry for the same inode. A symbolic link stores a path, so it can cross file systems but may become dangling.

Now take user asha, group dev and umask 0027. The allowed mask is 0750 because those are the permission bits not removed by the umask. A new regular file starts from base mode 0666:

0666 & 0750 = 0640 = rw-r-----

A new directory starts from base mode 0777:

0777 & 0750 = 0750 = rwxr-x---

For chmod 750 run.sh, owner digit 7 means 4+2+1 = rwx, group digit 5 means 4+1 = r-x, and others digit 0 means ---. Regular-file creation normally omits execute bits from its base mode. A directory needs execute permission for traversal, which is why its base mode includes it.

IPC, Networking and Commands That Reveal the Model

A pipe carries a byte stream between endpoints. A signal is an asynchronous notification. Shared memory lets processes map shared pages, while message queues preserve message boundaries. A socket is also represented by a file descriptor: socket() creates it, connect() associates a stream socket with a remote endpoint, and read() or write() moves bytes. Local pipes and network sockets therefore share descriptor operations but solve different communication problems.

For example, printf 'red\nblue\nred\n' | grep red | wc -l outputs 2. Three user-space processes are connected by two kernel pipe buffers. The shell creates the pipes, redirects standard input and output, then starts the commands. The vertical bar is shell syntax, not a kernel system call.

Match each observation tool to a question: strace shows system calls, ps and /proc expose process state, lsof lists open files, and ss reports sockets.

How GATE-Style Questions and Interviews Test Linux, Plus the Traps

Linux and operating-system questions commonly ask you to decode permissions, calculate a page offset and physical address, trace fork, exec and wait, interpret a system-call return, distinguish process states, or reason about pipes, descriptors, links and page faults.

Keep five corrections ready: Linux is not the shell; execve() replaces the current process image rather than creating a child; a zombie is not consuming CPU as a runnable task; a page fault is not automatically an error; and chmod 777 is not a sound default fix for access problems. Diagnose ownership and required access first.

Use Operating Systems for GATE: Deadlocks, Scheduling and Memory for the broad subject map. Then study Process Synchronization and Semaphores to connect shared process state with race conditions and safe coordination.

The Short Version and the Next Practice Step

Linux is the kernel, while a distribution packages a usable system. Applications request privileged services through system calls. The scheduler manages runnable work. Virtual-memory translation preserves the page offset. File access connects names, inodes, descriptors and permission bits.

For concept-led GATE study, follow GATE Guidance by Sanchit Sir. For interview-focused revision, use CS Fundamentals for Placements by Sanchit Sir. Finally, recompute 0x12345 -> 0x2A345 and 0666 with umask 0027 -> 0640 from memory on paper once, then verify both results.