Coreutils

GNU Coreutils is the package that ships the basic file, text, and shell utilities every Linux box assumes are present. ls, cp, mv, rm, cat, cut, sort, head, tail, wc, id, uname, date, true, false, and roughly a hundred of their siblings all live here. They are the smallest pieces the operator combines into pipelines, scripts, and one-liners.

Knowing which tool belongs to coreutils matters when the operator is on a stripped-down host. A bare-metal install or a hardened container often ships only what coreutils provides; anything richer (rg, jq, fd) has to be brought in. The reverse case is BusyBox on Alpine and most embedded boxes, where the same command names exist but with a smaller flag set, so coreutils-only options like ls --color=auto quietly do nothing.

The sections below walk the historical anatomy (fileutils, textutils, sh-utils), the tools in priority order, the constraints that bite when GNU extensions are not available, the on-disk layout, and the muscle-memory tasks the operator runs against coreutils on contact.

The three legacy packages merged in 2002. Today they are one binary set, but the category split is still how the manual is organized and how most operators carry the catalog in their head.

Category	What it does	Sample
fileutils	Manipulate files and directories on disk.	ls, cp, mv, rm, mkdir, ln, chmod, chown, dd, df, du
textutils	Read and reshape byte streams.	cat, head, tail, cut, paste, sort, uniq, tr, wc, nl, tac
sh-utils	Shell glue, identity, environment, time.	echo, printf, env, id, whoami, uname, date, sleep, true, false, yes, test, [

Fileutils

Fileutils is the half of coreutils that touches the filesystem. The operator reaches for it whenever the question is where does this byte live and who can read it. Every utility here is $PATH-resolved at /usr/bin, accepts -- to end flags, and honors LC_COLLATE for any output it sorts.

Command	Effect
ls	List directory contents
cp -a SRC DST	Recursive copy that preserves mode, ownership, and timestamps
mv SRC DST	Rename or move
rm -rf PATH	Recursive remove without prompts
mkdir -p PATH	Create the full path, no error if it exists
ln -s TARGET LINK	Make a symbolic link
chmod / chown / chgrp	Mode, owner, group changes
dd if=SRC of=DST bs=4M status=progress	Block-level copy with explicit block size
df -h / du -sh	Free space on mounts, size of a tree
stat PATH	Inode metadata, full

Recursive copy with attributes preserved. cp -a is the form the operator uses when the destination must look identical to the source, useful for staging payloads or moving artifacts off a target.

$ cp -a /etc/nginx /tmp/nginx.bak

(no output; success is silent)

Find the heaviest directories under the current tree. Sorted output, human-readable sizes, descending order.

$ du -sh */ 2>/dev/null | sort -rh | head

1.2G    var/
430M    home/
120M    opt/

Textutils

Textutils is the byte-stream half. Operators chain these tools into pipelines to slice logs, lift fields, count occurrences, and re-shape captured data without writing a script. Every tool in this category reads stdin when no file is given, which is what makes it composable.

Command	Effect
cat FILE	Concatenate to stdout
tac FILE	cat in reverse line order
head -n N / tail -n N	First / last N lines
tail -F FILE	Follow appended writes, survive rotation
cut -d, -f1,3	Pick fields 1 and 3 from a CSV
paste FILE1 FILE2	Line-by-line tabular merge
sort / sort -u / sort -t, -k2	Sort lexically, dedupe, sort by field
uniq -c	Collapse adjacent duplicates with counts
tr ' ' '\n'	Translate or delete characters
wc -l / wc -c	Count lines / bytes
nl	Number lines

Top talkers from an access log. The standard frequency pipeline, useful when the operator inherits a noisy log and wants the loudest sources first.

$ cut -d' ' -f1 access.log | sort | uniq -c | sort -rn | head

4821 10.0.0.4
 903 192.168.1.7
 412 203.0.113.55

Tail a rotating log without losing the handle. -F reopens the file when logrotate moves it.

$ tail -F /var/log/auth.log

Sh-utils

Sh-utils covers the smallest moving parts: identity, environment, clock, and the booleans every shell relies on. Most are one-shot commands the operator drops into a pipeline or script. [ and test are the same binary; true and false exist for their exit codes alone.

Command	Effect
echo / printf	Write to stdout (prefer printf in scripts)
env	List or run with a modified environment
id / whoami / groups	Current UID, GID, group membership
uname -a	Kernel name, release, machine
date -u +%FT%TZ	Now, in UTC, ISO-8601
sleep 5	Block for 5 seconds
yes / true / false	Infinite stream of y; exit 0; exit 1
test / [	File and string test predicates
nohup	Run a command immune to SIGHUP
timeout 30s CMD	Kill CMD after 30 seconds
nice / ionice	Run at adjusted CPU / I/O priority

Constraints

• GNU long options (--color=auto, --time=ctime, --block-size=1M) are GNU coreutils extensions. BSD coreutils (macOS) and BusyBox accept a smaller set; portable scripts stick to short flags and POSIX-defined behavior.

• ls --color=auto produces ANSI escape sequences when stdout is a TTY. Pipelines and command substitutions disable the color on their own; redirecting to a file with ls --color=always does not.

• rm does not prompt by default; rm -rf / will run as far as the kernel lets it. GNU rm refuses / itself only when --preserve-root is set (the default since 8.0).

• cp and mv follow symlinks at the source by default. Use cp -P / mv -P (or cp -a) when the operator needs the link preserved.

• dd is single-threaded, has no progress output without status=progress (GNU only), and silently truncates with of= if the operator forgets conv=notrunc.

• sort uses $LC_ALL and $LC_COLLATE to pick the collation order. LC_ALL=C sort is the byte-wise sort most pipelines actually want.

Files

Installed location

Path	Purpose
/usr/bin/	The coreutils binaries on Debian, Ubuntu, Kali, RHEL, Arch.
/bin/	Symlink to /usr/bin/ on modern distros (UsrMerge).
/usr/share/man/man1/	One man page per utility (ls.1, cp.1, cut.1, …).
/usr/share/info/coreutils.info	The combined GNU info manual covering every utility.
/usr/share/doc/coreutils/	Package README, changelog, NEWS.

Variables

Locale

Variable	Purpose
LC_ALL	Overrides every other LC_* setting; LC_ALL=C gives byte-wise comparisons and untranslated messages.
LC_COLLATE	Collation order used by sort, uniq, and glob matching.
LC_NUMERIC	Decimal separator; LC_NUMERIC=C keeps . as the decimal point in printf.

Behavior

Variable	Purpose
POSIXLY_CORRECT	Force POSIX-conformant behavior, disabling GNU extensions. Useful when validating portable scripts.
BLOCK_SIZE / LS_BLOCK_SIZE / DF_BLOCK_SIZE	Default unit for ls -s, df, and du (human-readable, 1k, 1M, …).
TIME_STYLE	Format ls -l uses for the mtime column (long-iso, full-iso, +%F %T).
COLUMNS	Terminal width ls and column assume when stdout is not a TTY.

Common Tasks

Identify which coreutils version is on the box.

$ ls --version | head -1

ls (GNU coreutils) 9.4

Tell coreutils apart from BusyBox.

$ readlink -f "$(command -v ls)"

/usr/bin/ls            # GNU coreutils
/bin/busybox           # BusyBox (Alpine, embedded)

List every coreutils binary on this host.

$ dpkg -L coreutils | grep '^/usr/bin/'           # Debian/Ubuntu/Kali
$ rpm -ql coreutils | grep '^/usr/bin/'           # RHEL/Fedora
$ pacman -Ql coreutils | awk '$2 ~ "/usr/bin/"'   # Arch

Sort byte-wise, predictably, in any locale.

$ LC_ALL=C sort data.txt | uniq -c | sort -rn

Use the standalone GNU info manual for the full reference.

$ info coreutils

Run a command stripped of the operator’s environment.

$ env -i PATH=/usr/bin:/bin HOME="$HOME" bash

Time-bound a long-running command and capture both streams.

$ timeout 30s curl -fsSL https://target | tee body.html

References

• man 1 coreutils, man 7 coreutils-info (package overview).

• man 1 ls, man 1 cp, man 1 mv, man 1 rm, man 1 cat, man 1 cut, man 1 sort, man 1 uniq, man 1 head, man 1 tail, man 1 wc (the daily-driver utilities).

• info coreutils (the full GNU manual; richer than the man pages).

• The Terminal for the shell that drives these tools.

• Standard I/O for the standard streams every coreutils binary reads or writes.

• Filesystem for the on-disk surface fileutils operates on.

• Linux for the command quick-reference.

• GNU Coreutils home

• BusyBox (the slimmer alternative the operator meets on Alpine and embedded targets).