Filesystem

Filesystem#

The filesystem is one tree, rooted at /, where files, directories, devices, kernel objects, IPC endpoints, and remote mounts are all paths. Reading the tree is how the operator reads the host. Binaries sit on one branch, service logs on another, kernel-exposed process state on a third, credentials and configs in their own corners, and an implant hides in whichever branch the defender forgot to check.

The tree -L 1 command executed at the root / outputs the tree one level deep.

$ tree -L 1

/
├── bin     -> usr/bin    essential user binaries
├── sbin    -> usr/sbin   essential system binaries (root)
├── lib     -> usr/lib    essential shared libraries
├── lib64   -> usr/lib64  64-bit shared libraries
├── boot                  kernel, initramfs, bootloader
├── dev                   device nodes (sda, null, tty, ...)
├── etc                   system configuration files
├── home                  user home directories
├── media                 mount points for removable media
├── mnt                   mount points for temporary filesystems
├── opt                   self-contained third-party packages
├── proc                  kernel virtual fs: per-process state
├── root                  root user's home
├── run                   runtime data since boot (sockets, pids)
├── srv                   data served by this host (web, ftp)
├── sys                   kernel virtual fs: device + kernel state
├── tmp                   temporary files (often cleared at boot)
├── usr                   distribution-provided programs + data
└── var                   variable data: logs, spools, caches

The terrain map breaks down into seven topics; each has its own page below.

Files

The file as the universal Unix object. Regular, directory, device, socket, pipe, link.

Topics regular files, directories, devices, sockets, pipes.

Files

Filesystem Hierarchy Standard

The FHS layout. Where everything lives by convention across distributions.

Topics /bin, /etc, /var, /usr, /home.

FHS

Navigation

Navigation, search, and listing tradecraft. ls, find, locate, tree.

Tools ls, cd, pwd, find, locate.

Navigation

Transfers

Copy, move, and sync trees. cp, mv, rsync, scp.

Tools cp, mv, rsync, scp, sftp.

Transfers

Reading and Writing

Read and write file content from the shell. Streams, buffers, redirections.

Tools cat, less, more, head, tail.

Reading and Writing

Common Tasks#

Map mounts and free space (what is mounted, where, with which options).

$ findmnt --real
$ df -hT
$ mount | column -t
$ cat /etc/fstab

Find sensitive files fast (creds, keys, tokens, configs).

$ sudo find / -type f \( -name '*.pem' -o -name 'id_rsa*' -o -name '.env' -o -name '*.kdbx' \) 2>/dev/null
$ sudo grep -RIn -E 'password|secret|api[_-]?key|token' /etc /opt 2>/dev/null | head
$ sudo find /home /root -name '.bash_history' -exec ls -la {} \;

Hunt SUID / SGID / capability binaries (privilege-escalation surface).

$ sudo find / -perm -4000 -type f 2>/dev/null
$ sudo find / -perm -2000 -type f 2>/dev/null
$ sudo getcap -r / 2>/dev/null

Find world-writable (common persistence and tampering vectors).

$ sudo find / -xdev -type d -perm -0002 2>/dev/null
$ sudo find / -xdev -type f -perm -0002 2>/dev/null
$ sudo find / -xdev -nouser -o -nogroup 2>/dev/null

Find recently modified files (what changed, when).

$ sudo find / -xdev -mmin -60 -type f 2>/dev/null
$ sudo find / -xdev -newer /etc/hostname -type f 2>/dev/null | head
$ ls -lat /tmp /var/tmp /dev/shm | head

Check inode and disk pressure (silent failures hide here).

$ df -i
$ du -xhd1 / 2>/dev/null | sort -h
$ sudo lsof +L1

Mount and unmount (attach a filesystem, persist or temporarily).

$ sudo mount /dev/sdb1 /mnt
$ sudo mount -o ro,noexec /dev/sdb1 /mnt
$ sudo mount -a                       # everything in /etc/fstab
$ sudo umount /mnt; sudo umount -l /mnt   # lazy if busy

Find files by name and content (the daily search).

$ find / -xdev -name '*.conf' 2>/dev/null
$ sudo grep -RIn 'pattern' /etc 2>/dev/null
$ locate -i secret 2>/dev/null
$ rg -nI 'pattern' /opt 2>/dev/null

Free up space fast (biggest offenders, log rotation, package cache).

$ sudo du -xh / 2>/dev/null | sort -h | tail -20
$ sudo journalctl --vacuum-time=7d
$ sudo apt clean; sudo dnf clean all 2>/dev/null
$ sudo find /var/log -type f -name '*.gz' -mtime +30 -delete

Check and repair a filesystem (offline fsck, online btrfs/xfs).

$ sudo fsck -n /dev/sdb1            # read-only check
$ sudo fsck -y /dev/sdb1            # auto-repair (unmounted)
$ sudo xfs_repair -n /dev/sdb1
$ sudo btrfs scrub start -B /mnt

Sync and compare directory trees (copy with verification).

$ rsync -aHAX --delete src/ dst/
$ rsync -avzn src/ user@host:/dst/   # dry-run over SSH
$ diff -rq dirA dirB
$ sha256sum file* | sort

Manage swap (enable, disable, resize).

$ swapon --show; free -h
$ sudo fallocate -l 2G /swapfile && sudo chmod 600 /swapfile
$ sudo mkswap /swapfile && sudo swapon /swapfile
$ sudo swapoff -a

References#

man 7 hier (the layout of the Linux filesystem hierarchy).
man 8 mount, man 8 umount, man 5 fstab, man 8 findmnt (mount surface).
man 1 find, man 1 df, man 1 du, man 1 lsof, man 1 rsync (tree, space, sync).
man 8 fsck, man 8 xfs_repair, man 8 btrfs (filesystem check and repair).
FHS for the Filesystem Hierarchy Standard layout.
Files for the file as the universal Unix object.
Navigation for navigation, search, and listing tradecraft.
Archives for archiving and compression.
Encryption for at-rest, per-file, and per-archive encryption.
Disks for block devices, partitions, and LVM.
Permissions for the DAC, capability, and MAC layer.
Filesystem Hierarchy Standard 3.0

Filesystem

Contents

Filesystem#

Common Tasks#

References#