1.0 Linux Architecture
1.0 Linux Architecture — Layer 0 for Operators
BLUF: Before privesc tooling, map the machine as a stack: firmware → bootloader → kernel → PID 1 → services/session → identity → filesystem → memory. Enumeration is reading that stack, not spraying commands.
Reading order: this file → hub → deep dives. Parent map: study linux-ow64/content/00-domain-map.md.
Mental model
UEFI firmware → Bootloader (GRUB) → Kernel (+ initramfs)
→ PID 1 (usually systemd) → units / getty / display manager
→ user session (shell or desktop)
| Layer | What you are looking at | Why it matters |
|---|---|---|
| Firmware / boot | Secure Boot, boot order, recovery | Persistence below OS; bootkits are rare but real |
| Kernel | Scheduler, VFS, net, drivers, LSM | CVE matching, audit hooks, container isolation |
| PID 1 / init | Unit graph, targets, sockets | Persistence, timers, weak service configs |
| User space | Processes, shells, daemons | Your foothold lives here |
| Storage | Block → VFS → mounts → ACLs | Loot, writable paths, encryption state |
| Memory | VA maps, page cache, swap | Creds in process memory; /proc as live view |
1. Boot → interactive
Firmware
Most modern hosts use UEFI (not legacy BIOS). Firmware loads a bootloader from the ESP (/boot/efi, typically FAT). Secure Boot (when on) verifies signed bootloaders/kernels — relevant when assessing boot persistence or custom kernels.
[ -d /sys/firmware/efi ] && echo UEFI || echo legacy-or-hidden
efibootmgr -v 2>/dev/null | head
Bootloader → kernel → initramfs
GRUB (common on servers/desktops) loads the kernel and initramfs. Initramfs unlocks disks (LUKS), loads modules, mounts the real root, then execs PID 1.
uname -r
ls /boot/vmlinuz-* /boot/initrd* /boot/initramfs* 2>/dev/null
cat /proc/cmdline
PID 1 and the session
On most current distros PID 1 is systemd. It brings the system to a target (e.g. multi-user.target, graphical.target), starts getty or a display manager (GDM/SDDM/LightDM), then a user session (shell or desktop).
ps -p 1 -o pid,cmd
systemctl get-default
systemctl is-system-running 2>/dev/null
loginctl 2>/dev/null | head
Operator note: Long uptime + old kernel = patch gap. Container PID 1 ≠ host PID 1 — always check whether you are in a container before chasing kernel exploits.
2. Privilege model
Linux keeps a monolithic kernel in privileged mode (x86_64 ring 0 / ARM64 EL1) and everything else in user mode (ring 3 / EL0). User code reaches the kernel only through syscalls.
| Concept | Meaning for operators |
|---|---|
| UID / GID | Numeric identity; names are cosmetic (passwd/group/NSS) |
| Effective vs real IDs | SUID/SGID and setuid flip effective IDs |
| Capabilities | Fine-grained “pieces of root” (CAP_NET_RAW, CAP_SYS_ADMIN, …) |
| LSM | SELinux / AppArmor policy on top of DAC |
| sudo | Policy-mediated elevation; sudo -l is enumeration, not noise |
id
capsh --print 2>/dev/null | head -20
getcap -r /usr /bin /sbin 2>/dev/null | head
sestatus 2>/dev/null; aa-status 2>/dev/null | head
Deep dive: SUID/caps abuse → 1.1b.
3. Process model
A process is a kernel task_struct: PID, PPID, credentials, file descriptors, memory maps, namespaces, cgroup membership. Threads share an address space; ps//proc show the tree you operate in.
ps auxf | head -40
ls /proc/self
tr '\0' ' ' < /proc/1/cmdline; echo
ls -l /proc/self/ns
cat /proc/self/cgroup | head
/proc is live state — reading it leaves no file on disk. That makes it the primary post-foothold microscope.
4. Critical services (what to notice first)
| Component | Role | Operator hook |
|---|---|---|
| systemd | Unit graph, sockets, timers | Weak ExecStart, writable unit dirs, timers as cron-class persist |
| journald | Central logs | What you generate; what blue team sees |
| sshd | Remote shell | Keys, authorized_keys, agent sockets |
| cron / anacron | Legacy schedules | Writable scripts in cron paths |
| Container runtimes | docker / containerd / podman | Socket access ≈ host root class risk |
systemctl list-units --type=service --state=running | head
systemctl list-timers --all | head
ss -tunlp 2>/dev/null | head
ls -la /var/run/docker.sock /run/containerd/containerd.sock 2>/dev/null
5. Memory (concept)
Each process has a virtual address space. The kernel maps pages to RAM or to swap. The page cache holds file-backed pages for speed.
free -h
swapon --show
head /proc/self/maps
# Concept only: /proc/PID/mem exists; dumping it is a deep-dive / authz action
Why it matters: secrets often live in process memory or in files that spent time in page cache. Prefer finding files and sockets before memory games.
6. Disk and filesystems
Block device → partition (GPT) → FS (ext4/XFS/…) → VFS mount → inode → dentry
Optional: LVM → LUKS/dm-crypt → filesystem
| Idea | Operator relevance |
|---|---|
| Mount options | nosuid/noexec/nodev change privesc surface |
| Inodes / permissions | Classic DAC; sticky bit on /tmp |
| FHS | Where config, logs, and loot live (see below) |
| LUKS / LVM | Encrypted-at-rest ≠ encrypted-while-mounted |
lsblk -f
findmnt -lo TARGET,SOURCE,FSTYPE,OPTIONS
df -hT
cat /etc/crypttab 2>/dev/null
ls /dev/mapper 2>/dev/null
FHS — first-pass map
| Path | Focus |
|---|---|
/etc | Host config, sudoers, cron, units |
/home, /root | Keys, history, tooling |
/var | Logs, web roots, DBs, spool |
/usr, /opt | Binaries, SUID, vendor agents |
/tmp, /var/tmp, /dev/shm | Writable staging |
/proc, /sys | Kernel/process interfaces |
7. Config store
| Store | Examples |
|---|---|
| Flat files | /etc/passwd, /etc/ssh/sshd_config |
| Unit drop-ins | /etc/systemd/system/*.service.d/ |
| sysctl | /etc/sysctl.conf, /etc/sysctl.d/ |
| NSS | /etc/nsswitch.conf → files / LDAP / SSSD |
ls /etc/systemd/system/*.wants 2>/dev/null | head
grep -r . /etc/sysctl.d/ 2>/dev/null | head
getent passwd $(whoami)
8. Isolation — namespaces and cgroups
Containers are namespaces + cgroups + (usually) a separate rootfs, not a separate kernel.
| Namespace | Separates |
|---|---|
| pid / mnt / net / uts / ipc / user / cgroup | Process tree, mounts, network, hostname, … |
ls -la /.dockerenv /run/.containerenv 2>/dev/null
cat /proc/1/cgroup | head
hostname; cat /etc/hostname
# Compare host vs container: many PIDs? host networking? privileged?
Escape methodology → 1.1c / AI6 in hub index.
9. Identity databases (quick)
/etc/passwd— world-readable account map/etc/shadow— root-readable hashes/etc/group— group membership- NSS —
getentmay show LDAP/AD users the flat files omit
id; getent passwd $(whoami)
awk -F: '$3>=1000 && $3<65534 {print $1,$3,$7}' /etc/passwd
getent group sudo docker lxd adm disk wheel 2>/dev/null
10. Observe map (Layer 0 cheat sheet)
| Goal | Commands |
|---|---|
| Boot / firmware | [ -d /sys/firmware/efi ], efibootmgr, cat /proc/cmdline |
| OS / kernel / arch | uname -a, cat /etc/os-release, cat /proc/version |
| Init / services | ps -p 1, systemctl get-default, systemctl list-units --state=running |
| Processes | ps auxf, ls /proc/self/ns |
| Memory | free -h, swapon --show |
| Disk / mounts | lsblk -f, findmnt, df -hT |
| Identity | id, getent passwd, getent group |
| Hardening hints | sestatus, aa-status, sysctl -a | head |
| Container? | /.dockerenv, /proc/1/cgroup, capsh --print |
Foundation → deep dive handoff
| Topic | Continues in |
|---|---|
| OPSEC / quiet enum | 1.1a |
| SUID, cron/systemd, kernel ID | 1.1b |
| Loot, persist, pivot, containers, chain | 1.1c |
| Pillar hub (BLUF / MITRE / AI index) | 1. Linux |
Part of Red Teaming 101 · Pillar 1.