Kernel & Shell

1.3. Kernel & Shell#

You’ve learned how to navigate the terminal and run commands. Now it’s time to understand what’s happening behind the scenes. This section explores the layered architecture of Linux: the kernel that controls hardware, the shell that interprets your commands, and the processes that execute your programs.

1.3.1. The Layered Architecture of Linux#

Think of Linux as having layers:

┌─────────────────────────────────────┐
│   Your Applications                 │
│   (Firefox, VS Code, Bash, etc.)    │
└─────────────────────────────────────┘
            ↓
┌─────────────────────────────────────┐
│   Shell (Bash, zsh, etc.)           │
│   Interprets commands               │
└─────────────────────────────────────┘
            ↓
┌─────────────────────────────────────┐
│   System Libraries (glibc, etc.)    │
│   Provide common functions          │
└─────────────────────────────────────┘
            ↓
┌─────────────────────────────────────┐
│   Linux Kernel                      │
│   Manages hardware, processes, etc. │
└─────────────────────────────────────┘
            ↓
┌─────────────────────────────────────┐
│   Hardware                          │
│   CPU, Memory, Disk, Network, etc.  │
└─────────────────────────────────────┘

Each layer abstracts away complexity. You don’t directly control the CPU or memory—the kernel does. The shell translates your commands into kernel operations.

1.3.2. The Kernel: The Core of the Operating System#

The kernel is the core of the operating system. It’s a program that runs with special privileges and controls everything.

1.3.2.1. What Does the Kernel Do?#

1. Process Management

  • Decides which processes run and when

  • Allocates CPU time to different programs

  • Allows multitasking (many programs running simultaneously)

2. Memory Management

  • Allocates RAM to different programs

  • Protects programs from interfering with each other

  • Manages virtual memory (using disk as extra RAM)

3. File System Management

  • Provides the interface to read/write files

  • Manages storage on disk

  • Controls file permissions

4. Hardware Abstraction

  • Provides a uniform interface to different hardware

  • Drivers communicate with specific devices

  • Programs don’t need to know hardware details

5. Networking

  • Manages network cards and connections

  • Routes data between programs and the network

1.3.2.2. Kernel Modes: User Mode vs Kernel Mode#

The CPU has two modes:

User Mode:

  • Where normal applications run

  • Limited access to hardware

  • Can’t directly modify memory or hardware

  • Safe—one program can’t crash the entire system

Kernel Mode:

  • Where the kernel runs

  • Full access to all hardware

  • Can modify memory and hardware directly

  • Privileged—only the kernel operates here

When a program needs hardware access, it makes a system call to ask the kernel, which temporarily switches to kernel mode to perform the operation.

User Program → System Call → Kernel (Kernel Mode)
                             ↓ (performs privileged operation)
                             Hardware
                             ↑
                          Result
                             ↓
                          Back to User Mode

1.3.3. The Shell: Your Command Interpreter#

The shell is the program that interprets your commands and turns them into actions. It’s a translator between you and the kernel.

1.3.3.1. How the Shell Works#

  1. You type a command:

    $ ls -la /tmp

  2. The shell parses it:

    • Command: ls

    • Options: -la

    • Argument: /tmp

  3. The shell finds the program:

    • Searches for ls in directories listed in $PATH

  4. The shell creates a process:

    • Asks the kernel to run the ls program

    • Passes options and arguments to the program

  5. The program executes:

    • ls reads the directory

    • Prints results to the terminal

  6. The shell waits:

    • Waits for the program to finish

    • Returns control to you

1.3.3.2. The Shell is Just Another Program#

This is important: the shell is not special. It’s just a program like any other. Your shell (Bash) is running as a process, waiting for your commands.

This is why you can:

  • Switch shells (bash vs zsh vs fish)

  • Run a shell script (a file of commands)

  • Start multiple shells

  • Even run shells inside shells

1.3.3.3. Common Shells#

Shell

Details

Bash

Most common, feature-rich, default on most Linux systems

sh

Original Unix shell, minimal, POSIX-compliant

zsh

Feature-rich, popular on macOS, great for interactivity

fish

User-friendly, but less POSIX-compatible

PowerShell

Windows shell, object-oriented, becoming more Unix-like

You can see which shells are available on your system:

$ cat /etc/shells

And check your current shell:

$ echo $SHELL
/bin/bash

$ ps $$

1.3.4. Processes: Running Programs#

A process is an instance of a running program. It has its own memory, file descriptors, and state.

1.3.4.1. Process Basics#

When you run a command, the shell creates a process:

$ sleep 100

This creates a sleep process that runs for 100 seconds. Your shell waits for it to finish before showing the prompt again.

1.3.4.2. Process IDs (PIDs)#

Every process has a unique Process ID (PID):

$ echo $$
12345

This shows the current shell’s PID (12345). You can see all processes:

$ ps
  PID TTY      STAT   TIME COMMAND
12345 pts/0    Ss     0:00 /bin/bash
12400 pts/0    R+     0:00 ps

1.3.4.3. Foreground vs Background#

By default, commands run in the foreground—the shell waits for them to finish.

To run a command in the background, add &:

$ sleep 100 &
[1] 12405
$

The [1] is a job number, and 12405 is the PID. Your shell returns the prompt immediately.

You can see background jobs:

$ jobs
[1]+  Running                 sleep 100 &

Bring a job back to foreground with fg:

$ fg
sleep 100

1.3.4.4. Parent and Child Processes#

When a process creates another process, the original is the parent, and the new one is the child.

Example:

$ bash              # Creates a child bash shell
$ exit              # Exits the child shell

You can see parent-child relationships:

$ ps -f
UID        PID  PPID  CMD
alice    12345    10 /bin/bash      (parent shell)
alice    12401 12345 /bin/bash      (child shell created by first bash)

The PPID column shows the parent process ID.

1.3.4.5. Process States#

Processes can be in different states:

  • Running (R): Currently executing on the CPU

  • Sleeping (S): Waiting for something (I/O, user input, timer)

  • Stopped (T): Paused by a signal

  • Zombie (Z): Finished but parent hasn’t cleaned up

Most processes are sleeping, waiting for events.

1.3.5. Seeing Processes in Action#

1.3.5.1. ps — List Processes#

The ps command shows processes:

# Show your processes
$ ps

# Show all processes with details
$ ps aux

# Show in tree format
$ ps f

# Show processes with full command line
$ ps -ef

1.3.5.2. top — Monitor Processes#

The top command shows a live, updating view of processes:

$ top

Press q to quit. Shows:

  • CPU usage

  • Memory usage

  • Which processes are using the most resources

  • Real-time updates

1.3.5.3. kill — Send Signals#

You can send signals to processes to control them:

# Terminate a process gracefully
$ kill 12345

# Force kill a process (dangerous!)
$ kill -9 12345

# List available signals
$ kill -l

Common signals:

  • TERM (15): Terminate gracefully

  • KILL (9): Force kill (process can’t ignore)

  • STOP (19): Pause the process

  • CONT (18): Resume a paused process

1.3.6. The Process Creation Pipeline#

Here’s what happens when you type a command:

1. You type: $ firefox
           ↓
2. Shell reads your input
           ↓
3. Shell parses: program="firefox", args=()
           ↓
4. Shell finds /usr/bin/firefox
           ↓
5. Shell calls kernel: fork() + exec()
           ↓
6. Kernel creates new process (child of shell)
           ↓
7. Kernel loads firefox program into memory
           ↓
8. Firefox runs
           ↓
9. Shell waits (blocking) for firefox to finish
           ↓
10. Firefox exits
           ↓
11. Kernel notifies shell
           ↓
12. Shell shows prompt again

This is why the prompt doesn’t return until the program finishes—unless you use &.

1.3.7. Key Concepts Summary#

✓ Kernel: Core of OS, manages hardware, processes, memory, files
✓ Shell: Interpreter of commands, just another program
✓ Process: A running instance of a program with its own memory and ID
✓ Foreground: Shell waits for program to finish (normal)
✓ Background: Program runs while shell returns prompt (&)
✓ Parent/Child: Processes form a hierarchy
✓ Signals: Ways to communicate with processes

Understanding these concepts is crucial for debugging, scripting, and system administration. When something goes wrong, you’ll think about which process is the problem and what signals it needs.

Contents