Linux Architecture & File System Basics

Linux architecture defines how the operating system is structured, how components interact, and how users, processes, and hardware communicate. Understanding this architecture is essential for pentesters because it reveals how the system behaves internally and where weaknesses may exist. The file system is the foundation of Linux operations, and every security test involves navigating, analyzing, and manipulating the file structure.

High-Level Structure of Linux

Linux follows a layered architecture. Each layer performs dedicated tasks while interacting with others. Pentesters study these layers to understand where vulnerabilities may appear and how system-level controls affect attack methods.

Core conceptual layers include:

• Hardware

• Kernel

• System libraries

• System utilities

• User applications

• Shell and user environment

Each layer affects how commands execute, how privileges are controlled, and how attackers may move within the system.

The Role of the Kernel

The kernel is the core of Linux. It manages hardware, processes, memory, security policies, and system calls. Understanding the kernel is important because kernel vulnerabilities often lead to full system compromise.

Key responsibilities include:

• Process management

• Memory management

• Device control

• File system handling

• Networking stack handling

• Enforcing permissions and security policies

Pentesters focus on kernel version, loaded modules, sysctl configurations, and potential privilege escalation vulnerabilities.

System Calls and User Space Interaction

Linux programs operate in user space, while sensitive operations occur in kernel space. System calls bridge this gap and allow user applications to request kernel services. Attackers often exploit vulnerabilities in how system calls handle memory, file paths, or permissions.

System call interaction is crucial for understanding:

• Privilege boundaries

• Input handling

• Process execution

• File operations

• Network communications

Many privilege escalation exploits abuse system call behavior.

System Libraries and Binaries

System libraries, especially glibc, provide essential functions to applications. System binaries offer tools used for scripting, automation, and daily operations. Vulnerabilities or misconfigurations in these components directly affect system security.

Libraries affect:

• Memory allocation

• Thread management

• Input/output functions

• Authentication mechanisms

System binaries such as bash, sudo, and systemd influence how commands execute and how privileges elevate.

Shell and User Environment

The shell provides a text interface to interact with the system. Bash, Zsh, and other shells load environment variables, aliases, and configurations that influence execution behavior.

Shell-related exposures include:

• PATH manipulation

• Writable shell configuration files

• Unsafe aliases

• Unsafe environment variables

• Execution hijacking

Pentesters inspect user environments to find escalation opportunities.

File System Structure Overview

The Linux file system organizes data in a hierarchical structure. Everything is treated as a file, including hardware, devices, processes, and sockets. Pentesters must understand this structure to navigate systems efficiently and locate sensitive files.

The root directory / sits at the top, and all other directories descend from it. Critical directories include:

• /bin for essential binaries

• /sbin for system binaries

• /usr for user applications

• /etc for configuration files

• /home for user data

• /root for root user data

• /var for logs, cache, spool files

• /lib and /lib64 for libraries

• /opt for third-party applications

• /tmp and /dev/shm for temporary storage

• /dev for device files

• /proc for process and kernel information

• /sys for hardware and kernel interfaces

Each directory contains potential security weaknesses depending on permissions and stored content.

Important Directories for Pentesting

Pentesters commonly focus on directories that reveal system details or store sensitive content.

Key targets include:

• /etc/passwd and /etc/shadow for user credentials

• /etc/sudoers for privilege configuration

• /var/log for log analysis

• /proc for process inspection

• /home directories for saved credentials or SSH keys

• /opt for custom applications

• /tmp for writable areas useful in exploitation

• /root for restricted data accessible only with elevated privileges

Each directory provides information necessary for enumeration, exploitation, and post-exploitation.

Permissions and Ownership Basics

Linux controls access using three permission types:

• Read

• Write

• Execute

These apply to three entity types:

• Owner

• Group

• Others

Ownership is critical in pentesting because misconfigured permissions allow attackers to modify scripts, read secrets, or execute unauthorized files. Privilege escalation often depends on identifying writable directories or binaries.

Special Permission Types

Linux employs additional permission mechanisms that influence how executables and directories behave.

Important special permissions include:

• SUID for executing with owner privileges

• SGID for executing with group privileges

• Sticky bit for restricting deletion in shared directories

• Capabilities for granular privilege control

Pentesters analyze these settings to identify privilege escalation vectors.

Virtual File Systems

Linux exposes system and kernel information through virtual file systems. These do not store actual files but show real-time system data.

Key virtual file systems include:

• /proc for processes, system calls, kernel information

• /sys for kernel and hardware control

• /dev for device interfaces

Pentesters read /proc to examine memory, running processes, open files, and network connections.

Log Files and System Monitoring Data

Logs are crucial for both attackers and defenders. They reveal system activity, authentication events, service behavior, and potential misconfigurations.

Important logs include:

• Authentication logs

• System logs

• Application logs

• Cron logs

• Kernel logs

Pentesters examine logs for traces of misconfiguration or sensitive data leakage.

File System Mounts and Storage

Mount points define how file systems are attached to the system. Misconfigured mount options can increase the attack surface.

Common issues include:

• Writable removable media

• No nosuid or noexec flags

• Network shares with weak controls

• Unprotected NFS or Samba shares

Inspecting mount configurations helps pentesters locate insecure storage.

Device Files and Hardware Abstraction

Device files in /dev allow user-space programs to interact with hardware. Misconfigured device files can allow attackers to access disks, terminals, or memory.

Important device files include:

• /dev/null

• /dev/tty

• /dev/sda (or other storage devices)

• /dev/mem for memory access

Access to device files can reveal sensitive information or enable kernel-level attacks.

System Initialization and Startup

Linux uses systemd or other init systems to manage startup services. Misconfigured startup scripts provide persistence and privilege escalation opportunities.

Startup elements include:

• systemd unit files

• init scripts

• rc.local files

• Service environment files

Attackers often target writable or poorly configured service files to maintain access.

Intel Dump

• Linux architecture consists of hardware, kernel, libraries, utilities, shell, and applications

• Kernel manages processes, memory, devices, networking, and permissions

• System calls connect user space to kernel space

• Libraries and binaries influence system behavior and vulnerability exposure

• Shell environments affect command execution and escalation vectors

• File system hierarchy begins at / and includes critical directories

• /etc, /var, /home, /root, /proc, and /tmp are essential for pentesting

• Permissions govern access using owner, group, and others

• SUID, SGID, sticky bit, and capabilities influence privilege escalation

• Virtual file systems expose process and kernel information

• Logs reveal system activity and potential weaknesses

• Mount points and device files expand attack vectors

• Startup scripts and services provide paths for persistence and exploitation