Keywords
What Is a Shell?
A shell is a program that reads commands typed by a user and executes the appropriate programs in response. It is sometimes called a command interpreter. The shell is not part of the kernel — it is an ordinary user-space process. A login shell is the shell created when a user first logs in; it sets its initial working directory to the user’s home directory from /etc/passwd.
Shells are designed for both interactive use (typing commands at a prompt) and shell scripting (text files of commands run as programs). Each shell provides variables, loops, conditionals, I/O redirection, pipelines, and functions.
The Four Major Unix Shells
Written by Steve Bourne at AT&T Bell Labs. The oldest widely used shell and the standard for Seventh Edition UNIX. Introduced the features all shells share: I/O redirection, pipelines, filename globbing, variables, command substitution, and background execution. All later UNIX systems include it.
Written by Bill Joy at UC Berkeley. Its flow-control syntax resembles C. Added interactive features not in sh: command history, command-line editing, job control, and aliases. Not backward compatible with sh.
Written by David Korn at AT&T Bell Labs as the successor to sh. Maintained full backward compatibility with sh while adding csh-like interactive features. Now conforms to the POSIX shell standard.
The GNU project’s reimplementation of sh, written by Brian Fox and Chet Ramey. The most widely used shell on Linux. On Linux, /bin/sh is provided by bash emulating sh. POSIX-compatible and includes interactive features from both csh and ksh.
Users and the /etc/passwd File
Every user is uniquely identified by a login name and a numeric user ID (UID). Both are defined in /etc/passwd. Each line defines one account with seven colon-separated fields:
username:password:UID:GID:comment:home_dir:login_shell alice:x:1001:1001:Alice Smith:/home/alice:/bin/bash
- username — the login name (e.g., alice)
- password — today usually
x, meaning password is in /etc/shadow - UID — numeric user identifier (e.g., 1001)
- GID — numeric primary group identifier (e.g., 1001)
- comment — usually the user’s full name
- home directory — starting directory at login (e.g., /home/alice)
- login shell — program run at login (e.g., /bin/bash)
Shadow Passwords — /etc/shadow
For security, the actual encrypted password is stored in /etc/shadow, readable only by root. The x in the password field of /etc/passwd signals this. This separation exists because /etc/passwd must be world-readable (many programs look up user info), but exposing password hashes to all users would allow offline brute-force attacks.
Groups and the /etc/group File
Users are organised into groups for access control. Every group is defined in /etc/group with four fields:
group_name:password:GID:user_list developers:x:1002:alice,bob,carol
- group_name — unique group name (e.g., developers)
- password — rarely used; usually empty or x
- GID — numeric group identifier (e.g., 1002)
- user_list — comma-separated list of member usernames
A user’s primary group is defined in their /etc/passwd entry. Users can also belong to multiple supplementary groups listed in /etc/group. A process has access to resources permitted for any group to which its user belongs.
The Superuser — root
The superuser has UID 0 and login name root. Root bypasses all permission checks in the system and can:
- Read and write any file regardless of permissions
- Send signals to any process
- Bind to network ports below 1024
- Mount and unmount filesystems
- Change any system configuration
Interview Questions
Answer: The kernel is the privileged central software that manages hardware and mediates access to all resources. It runs in kernel mode. The shell is an ordinary user-space program that reads commands and creates processes to run them. The shell uses system calls like fork() and exec() to ask the kernel to start programs. Unlike the kernel, the shell can be replaced, customised, and multiple shells can run at the same time on the same system.
Answer: (1) Username — the login name. (2) Password — today usually ‘x’ meaning the encrypted password is in /etc/shadow. (3) UID — numeric user identifier, used by the kernel for all permission checks. (4) GID — numeric primary group identifier. (5) Comment/GECOS — free-text field, usually the user’s full name. (6) Home directory — the initial working directory when the user logs in. (7) Login shell — the program executed to interpret the user’s commands at login.
Answer: The file /etc/passwd must be world-readable because many programs need to convert UIDs to usernames. If password hashes were stored there, any user on the system could copy them and run offline brute-force or dictionary attacks. Moving passwords to /etc/shadow — readable only by root — eliminates this attack surface. The ‘x’ placeholder in /etc/passwd tells authentication programs to look in /etc/shadow.
Answer: A user’s primary group is defined in /etc/passwd. Supplementary groups are additional groups the user belongs to, listed in /etc/group. They are useful because a user often needs access to multiple different resources owned by different groups — for example, a developer might belong to the “developers” group for code access, the “docker” group to run containers, and the “sudo” group for administrative tasks. A process succeeds in a permission check if its UID or any of its group IDs match the required permission.
Answer: Bash is the GNU reimplementation of the Bourne shell — POSIX-compatible (scripts written for sh work in bash) and feature-rich (incorporates interactive enhancements from csh and ksh). Being part of the GNU project made it freely available under the GPL, the natural choice for the Linux ecosystem. It is actively maintained, universally documented, and its scripting language is the de facto standard for Linux system administration.
Continue to Chapter 03
Next: The Linux filesystem — directory hierarchy, file types, hard links, symbolic links, and file permissions.