The Linux Kernel, User Space, and GNU Tooling

1. The kernel and user-space privilege boundary

The kernel runs in a privileged processor mode and owns direct control of memory mappings, devices, process scheduling, filesystems, network stacks, and security enforcement. Ordinary programs—including shells, web servers, package managers, and CI agents—run in user space with restricted privileges.

2. From a shell command to the kernel

When you enter cat /etc/os-release, Bash does not read the disk directly. It resolves the command, creates a process, and that process asks the kernel to open and read the file.

flowchart TD
  U["User or automation"] --> SH["Shell parses command"]
  SH --> EX["Executable starts in user space"]
  EX --> LIB["Libraries prepare requests"]
  LIB --> SC["System calls cross privilege boundary"]
  SC --> K["Kernel subsystems"]
  K --> FS["Filesystem, network, memory, or device"]
  FS --> K --> EX --> U

Common system calls include openat, read, write, close, fork/clone, execve, mmap, socket, and connect. You normally use higher-level commands and libraries rather than invoking system calls directly.

3. Kernel subsystems DevOps engineers encounter

4. GNU tooling, shells, libraries, and non-GNU components

A typical Linux distribution combines software from many projects. GNU contributes Bash, the GNU C Library on many distributions, Coreutils, Findutils, Grep, Sed, Gawk, Binutils, GCC, and other foundational tools. Linux itself is the kernel. Projects such as systemd, OpenSSH, util-linux, BusyBox, musl, LLVM, and many desktop or server components have separate origins.

5. The operational interfaces: /proc, /sys, and /dev

• /proc: a virtual view of processes and kernel state. Files such as /proc/cpuinfo, /proc/meminfo, and /proc/<pid> expose live information.
• /sys: the sysfs interface for devices, drivers, kernel objects, and selected configuration attributes.
• /dev: device nodes and special endpoints such as /dev/null, /dev/zero, terminals, disks, and pseudo-devices.

These paths look like ordinary files, but many are generated dynamically by the kernel. Reading is often safe; writing can change live system behavior and may require elevated privileges.

6. Inspect the layers on your machine

# Kernel identity and build information
uname -srmo
cat /proc/version

# Shell and command resolution
printf 'Login shell: %s\n' "$SHELL"
printf 'Current process: '
ps -p $$ -o comm=
type -a ls
command -V cat

# User-space implementation versions
ls --version 2>/dev/null | head -n 1 || true
bash --version | head -n 1
getconf GNU_LIBC_VERSION 2>/dev/null || true
ldd --version 2>&1 | head -n 1 || true

# Kernel-provided virtual interfaces
head -n 8 /proc/meminfo
ls -ld /proc /sys /dev

If ls --version fails, you may be using BusyBox or another non-GNU implementation. That is useful information, not an error in Linux itself.

7. Hands-on lab: build a kernel and user-space inventory

This lab creates a report without changing system configuration. It conditionally uses strace when available.

lab="$HOME/devops-academy/linux/chapter01/lesson02"
mkdir -p "$lab"
cd "$lab"

{
  printf '=== kernel ===\n'
  uname -a
  cat /proc/version

  printf '\n=== shell and utilities ===\n'
  bash --version | head -n 1
  command -V ls
  ls --version 2>/dev/null | head -n 1 || printf 'ls has no GNU-style --version output\n'

  printf '\n=== C library ===\n'
  getconf GNU_LIBC_VERSION 2>/dev/null || ldd --version 2>&1 | head -n 1 || true

  printf '\n=== virtual filesystems ===\n'
  findmnt -n -o TARGET,FSTYPE /proc /sys /dev 2>/dev/null || mount | grep -E ' on /(proc|sys|dev) '
} > layer-report.txt

if command -v strace >/dev/null 2>&1; then
  strace -o uname.trace -e trace=execve,openat,read,write,close uname -s >/dev/null
  printf 'System-call trace saved to %s/uname.trace\n' "$lab"
else
  printf 'strace is not installed; the main report is still complete.\n'
fi

less layer-report.txt

8. Common misconceptions

9. Knowledge check

10. Summary

The kernel owns privileged resource management; user-space programs request services through system calls. A complete Linux environment combines the kernel with shells, libraries, service managers, and utilities from GNU and many other projects. DevOps engineers diagnose systems by connecting observed commands and files to the layer that produced them.

11. Further reading

• Linux kernel documentation — core APIs, administration guides, and subsystem documentation.
• Linux man-pages project — system calls, library calls, and Linux-specific interfaces.
• GNU Coreutils manual — behavior of foundational GNU command-line utilities.
• GNU C Library manual — user-space library interfaces and system integration.
• proc(5), sysfs(5), and hier(7) manual pages — virtual interfaces and filesystem conventions.