3.1 OS Architecture & Shell Navigation

OS Architecture & Shell Navigation

An Operating System (OS) is the fundamental system software that manages computer hardware, allocates execution resources to software processes, and provides common services for application programs. For an IT support professional or systems administrator, interacting with an operating system extends far beyond graphical consumer interfaces. Mastery over OS architecture, kernel mechanics, shell navigation, and pipeline data manipulation forms the bedrock of automation, remote administration, and systems troubleshooting.

---

1. Operating System Architecture: Kernel vs. User Space

Modern microprocessor architectures (such as x86_64 and ARM64) enforce hardware-level privilege separation through CPU protection rings. These rings dictate which machine instructions a running program can execute and which memory addresses it can directly access.

+-----------------------------------------------------------------------------+
|                   CPU PRIVILEGE RINGS & ARCHITECTURE                        |
|                                                                             |
|   +---------------------------------------------------------------------+   |
|   |  USER SPACE (Ring 3 - Unprivileged Mode)                            |   |
|   |  - Web Browsers, Office Suites, Shells (Bash, PowerShell)           |   |
|   |  - User Applications & User-Space Libraries                         |   |
|   |  - Isolated virtual memory; no direct hardware access               |   |
|   +-----------------------------------+---------------------------------+   |
|                                       |                                     |
|                      SYSTEM CALLS API | (syscall / int 0x80 / sysenter)     |
|                                       v                                     |
|   +---------------------------------------------------------------------+   |
|   |  KERNEL SPACE (Ring 0 - Privileged Supervisor Mode)                 |   |
|   |  - Process Scheduler & Memory Manager                               |   |
|   |  - Virtual File System (VFS) & Network Stack                        |   |
|   |  - Hardware Device Drivers & Direct Hardware Control                |   |
|   +-----------------------------------+---------------------------------+   |
|                                       |                                     |
|                                       v                                     |
|   +---------------------------------------------------------------------+   |
|   |  PHYSICAL HARDWARE (CPU, RAM, Disks, Network Interfaces, GPUs)      |   |
|   +---------------------------------------------------------------------+   |
+-----------------------------------------------------------------------------+

Kernel Space (Ring 0 - Supervisor Mode)

The kernel is the core component of the operating system loaded into protected memory during the boot sequence. Operating in Ring 0 (Supervisor/Kernel Mode), the kernel has unrestricted, raw access to all physical CPU instructions, memory registers, I/O ports, and connected peripheral hardware.

Key responsibilities of the kernel include:

• Process Scheduling: Allocating CPU execution time slices across competing active threads (preemptive multitasking).
• Virtual Memory Management: Mapping isolated per-process virtual address spaces to physical RAM pages and disk-backed swap/paging files using the Memory Management Unit (MMU).
• Device Driver Abstraction: Providing uniform software interfaces to communicate with diverse physical hardware (storage controllers, network interface cards, display adapters).
• File System Operations & IPC: Managing storage structures and facilitating Inter-Process Communication (pipes, sockets, shared memory).

User Space (Ring 3 - User Mode)

All standard user applications, graphical desktop environments, background daemons/services, and command-line shells execute in Ring 3 (User Mode). In user mode, code executes with restricted privileges:

• Code cannot directly access physical hardware registers.
• Code cannot execute privileged CPU instructions (such as disabling hardware interrupts or modifying page tables).
• An unhandled crash or segmentation fault in a user-space application only terminates that individual process—it does not crash the underlying operating system kernel.

The System Call (Syscall) Interface

When a user-space program requires a hardware resource—such as reading a file from an NVMe drive, sending a packet over Ethernet, or spawning a new worker thread—it cannot perform the action directly. Instead, it must issue a System Call (syscall).

1. The user program invokes a wrapper function in a standard C runtime library (such as glibc in Linux or ntdll.dll / Win32 API in Windows).
2. The library executes a software interrupt instruction (e.g., syscall or sysenter), causing a controlled hardware context switch from Ring 3 to Ring 0.
3. The CPU jumps to the kernel's system call dispatch table, which validates arguments and executes the requested privileged kernel function (e.g., sys_read, sys_write, sys_open, sys_fork).
4. Upon completion, the kernel switches execution back to Ring 3 and returns the result or error code to the user application.

Monolithic Kernels vs. Microkernels

Operating systems implement their kernel architectures under two primary design philosophies:

---

2. Shells & Command-Line Interfaces (CLI vs. GUI)

A Shell is a specialized user-space program that acts as an interface between the user (or automation scripts) and the operating system kernel. It accepts textual commands, interprets them, and executes corresponding system programs or built-in system routines.

GUI vs. CLI in Enterprise IT Support

While a Graphical User Interface (GUI) provides visual affordances and intuitive point-and-click navigation for casual desktop users, the Command-Line Interface (CLI) is indispensable for IT power users and systems administrators:

• Automation & Scripting: CLI commands can be chained, scripted, parameterized, and executed unattended across thousands of fleet endpoints via configuration management platforms.
• Remote Administration & Bandwidth Efficiency: Managing headless remote servers over SSH (Secure Shell) or PowerShell Remoting (WinRM) consumes negligible network bandwidth compared to streaming graphical remote desktop pixels (RDP, VNC).
• Headless Server Deployment: Enterprise Linux and Windows Server Core instances omit the GUI completely to conserve CPU/RAM resources, eliminate display driver vulnerabilities, and shrink the attack surface.
• Precision & Repeatability: Textual commands provide deterministic results, can be version-controlled in Git, and eliminate human clicking errors during complex system recovery procedures.

---

3. Shell Paradigms: Linux Bash vs. Windows PowerShell & Cmd.exe

+-----------------------------------------------------------------------------+
|                        SHELL PIPELINE PARADIGMS                             |
|                                                                             |
|   [LINUX BASH: TEXT STREAM PIPELINE]                                        |
|   +------------+   Raw ASCII/UTF-8 Byte Stream   +------------+             |
|   | ps aux     | ------------------------------> | grep nginx |             |
|   +------------+  (Requires awk/sed/cut to parse)| +------------+             |
|                                                                             |
|   [WINDOWS POWERSHELL: OBJECT PIPELINE]                                     |
|   +-------------+  Strongly Typed .NET Objects   +------------------------+ |
|   | Get-Process | -----------------------------> | Where-Object Handles -gt| |
|   +-------------+  (Direct Property Access:      +------------------------+ |
|                     $_.CPU, $_.ProcessName, etc.)                           |
+-----------------------------------------------------------------------------+

Windows Command Prompt (cmd.exe)

cmd.exe is the legacy command-line interpreter originating from MS-DOS. It relies on static executable utilities and basic batch files (.bat, .cmd). It lacks modern programming constructs, has rudimentary string parsing capabilities, and has been superseded by PowerShell for all systems administration tasks.

Windows PowerShell

Introduced to overcome the limitations of cmd.exe, PowerShell is a task-based command-line shell and scripting language built on top of the Microsoft .NET framework:

• Verb-Noun Cmdlet Naming Standard: PowerShell commands (called cmdlets) follow a strict grammatical structure (e.g., Get-Service, Stop-Process, New-Item, Set-ExecutionPolicy).
• The Object-Oriented Pipeline: When a cmdlet executes, it does not output flat strings of text. Instead, it outputs structured .NET objects containing rich properties and methods. Chained commands receive structured objects directly, eliminating the need for complex string parsing or regex extraction.

  # Filtering processes by memory consumption directly using object properties:
  Get-Process | Where-Object WorkingSet64 -gt 200MB | Stop-Process -WhatIf
  

Linux Bash (Bourne Again Shell)

Bash is the default POSIX-compliant command language for most Linux distributions and macOS (historically):

• The Text Stream Philosophy (Unix Philosophy): "Write programs that do one thing and do it well. Write programs to work together. Write programs to handle text streams, because that is a universal interface."
• Byte Stream Pipelines: Linux commands emit raw character streams (ASCII or UTF-8). Data manipulation across pipes relies on powerful text-processing utilities such as grep, awk, sed, cut, sort, uniq, and tr.

  # Extracting PID of processes listening on port 80 via text manipulation:
  ss -tlpn | grep ':80 ' | awk '{print $NF}' | cut -d',' -f2
  

---

4. Directory Structure: Linux FHS vs. Windows Filesystem Architecture

Operating systems structure their storage drives hierarchically, but Linux and Windows implement fundamentally different root models.

+-----------------------------------------------------------------------------+
|                   DIRECTORY ARCHITECTURE COMPARISON                         |
|                                                                             |
|   [LINUX: FILESYSTEM HIERARCHY STANDARD (FHS)]                              |
|   / (Root)                                                                  |
|   ├── bin -> /usr/bin   (Essential user command binaries)                   |
|   ├── sbin -> /usr/sbin (System administration binaries)                    |
|   ├── etc               (Host-specific configuration files)                 |
|   ├── home              (User home directories: /home/alice)                |
|   ├── root              (Home directory for the root superuser)             |
|   ├── var               (Variable data: /var/log, /var/spool, /var/www)     |
|   ├── tmp               (Temporary files cleared on reboot)                 |
|   ├── dev               (Device nodes: /dev/sda, /dev/null, /dev/urandom)   |
|   ├── proc              (Virtual pseudo-filesystem for kernel/process info) |
|   ├── sys               (Virtual sysfs exporting kernel device objects)     |
|   └── usr               (User utilities, libraries, and documentation)      |
|                                                                             |
|   [WINDOWS: DRIVE LETTER VOLUMES]                                           |
|   C:\ (System Root Volume)                                                  |
|   ├── Windows           (Core OS binaries and libraries)                    |
|   │   └── System32      (Critical DLLs, drivers, and core executables)      |
|   ├── Program Files     (64-bit application installations)                  |
|   ├── Program Files (x86)(32-bit application installations on 64-bit OS)    |
|   ├── ProgramData       (Hidden shared application data/configuration)      |
|   └── Users             (User profile directories: C:\Users\Alice)          |
|       └── Alice\AppData (Local, LocalLow, Roaming user app configs)         |
+-----------------------------------------------------------------------------+

Linux Filesystem Hierarchy Standard (FHS)

In Linux, there are no drive letters. Everything is organized beneath a single root directory (/). Physical disk partitions, USB thumb drives, and network shares are "mounted" to specific directory attachment points within this unified hierarchy.

Windows Drive Letters & Standard Folders

Windows assigns physical disk partitions, CD/DVD optical drives, and mapped network drives distinct alphabetical drive letters followed by a colon and backslash (e.g., C:\, D:\, Z:\).

• C:\Windows: Contains the Windows NT operating system kernel, system fonts, and administrative components.
• C:\Windows\System32: Houses critical dynamic-link libraries (DLLs), hardware device drivers, and core system executables (cmd.exe, powershell.exe, taskmgr.exe).
• C:\Program Files: Default installation target for native 64-bit applications.
• C:\Program Files (x86): Dedicated installation target for legacy 32-bit applications running under the WoW64 (Windows 32-bit on Windows 64-bit) emulation subsystem.
• C:\ProgramData: A hidden directory used by software applications to store global, machine-wide configuration settings and databases.
• C:\Users\<Username>: User profile folders storing user-specific documents, desktop shortcuts, and personal application settings under the hidden AppData hierarchy (Local, LocalLow, Roaming).

---

5. Core Navigation & File Manipulation Commands

IT support technicians must fluidly navigate, inspect, and manipulate filesystem objects in both POSIX and Windows environments.

Linux CLI Command Suite

• pwd (Print Working Directory): Displays the current absolute directory path.
• cd (Change Directory): Navigates the filesystem.
  • cd /var/log (Absolute path navigation)
  • cd ../.. (Relative traversal up two parent levels)
  • cd ~ or cd (Return to current user's home directory)
  • cd - (Toggle back to the previous working directory)
• ls (List Directory Contents):
  • ls -l: Long format (permissions, owner, group, file size, timestamp).
  • ls -a: Include hidden files (files beginning with a dot .).
  • ls -lh: Human-readable file sizes (KB, MB, GB).
  • ls -la /etc: Comprehensive detailed listing of /etc.
• mkdir (Make Directory):
  • mkdir projects: Creates a single directory.
  • mkdir -p /opt/app/data/logs: Creates nested parent directories recursively without error.
• rmdir & rm (Remove):
  • rmdir empty_dir: Removes empty directories only.
  • rm file.txt: Deletes a file.
  • rm -r directory/: Deletes directory and contents recursively.
  • rm -rf /tmp/test: Forcefully removes files and subdirectories without prompting (-f ignores nonexistent files and suppresses confirmations).
• cp (Copy Files & Directories):
  • cp file.txt file_backup.txt: Copies a file.
  • cp -r /src/data/ /dst/backup/: Recursively copies an entire directory tree.
  • cp -p file.txt file_copy.txt: Preserves file timestamps, ownership, and mode attributes.
• mv (Move / Rename):
  • mv old_name.txt new_name.txt: Renames a file.
  • mv report.pdf /home/user/Documents/: Moves a file to another location.
• touch: Creates a new empty file if it doesn't exist, or updates access and modification timestamps of an existing file.
• cat & File Pagers:
  • cat file.txt: Concatenates and dumps entire file contents to stdout.
  • cat -n file.txt: Displays content with line numbers.
  • less file.txt: Interactive terminal pager allowing forward/backward scrolling and search (/search_term).
  • head -n 20 file.txt: Outputs the first 20 lines of a file.
  • tail -n 50 file.txt: Outputs the last 50 lines of a file.
  • tail -f /var/log/syslog: Continuously follows and streams new log lines in real time.
• grep & find:
  • grep -i "error" /var/log/nginx/error.log: Case-insensitive search for string.
  • grep -r "db_password" /etc/app/: Recursive directory text search.
  • find /var/log -type f -name "*.log" -mtime -7: Finds files modified within the last 7 days.
  • find /tmp -type f -size +100M -exec rm -f {} \;: Finds files larger than 100MB and deletes them.

Windows PowerShell Cmdlet Suite

PowerShell provides standard cmdlets alongside built-in aliases that mimic Unix and DOS commands:

---

6. Standard Streams, Redirection & Pipelines

In POSIX environments and modern shells, programs interact with the environment via three standardized I/O data channels known as Standard Streams, identified by numeric File Descriptors (FDs).

+-----------------------------------------------------------------------------+
|                         STANDARD I/O STREAMS                                |
|                                                                             |
|                  +--------------------------------+                         |
|                  |   KEYBOARD / INPUT REDIRECTION |                         |
|                  +--------------------------------+                         |
|                                  |                                          |
|                                  | stdin (File Descriptor 0)                |
|                                  v                                          |
|                         +-----------------+                                 |
|                         |     PROCESS     |                                 |
|                         |  (CLI Command)  |                                 |
|                         +-----------------+                                 |
|                                  |                                          |
|                 +----------------+----------------+                         |
|                 |                                 |                         |
|                 | stdout (FD 1)                   | stderr (FD 2)           |
|                 v                                 v                         |
|   +----------------------------+    +----------------------------+          |
|   | TERMINAL DISPLAY / OUTPUT  |    | TERMINAL DISPLAY / ERRORS  |          |
|   | (Redirect: > or >>)        |    | (Redirect: 2> or 2>&1)     |          |
|   +----------------------------+    +----------------------------+          |
+-----------------------------------------------------------------------------+

Redirection Operators

Redirection changes the source or destination of standard streams from default terminal hardware to files or other streams:

• > (Overwrite stdout): Directs standard output to a file, completely overwriting existing file contents (echo "status=active" > config.txt).
• >> (Append stdout): Directs standard output to a file, appending new data to the end of the file without deleting existing data (date >> /var/log/audit.log).
• < (Redirect stdin): Feeds the contents of a file into a command's standard input (mysql -u root -p dbname < backup.sql).
• 2> (Redirect stderr): Directs error messages exclusively to a specified file (find / -name secret.txt 2> /dev/null).
• 2>&1 (Merge stderr into stdout): Combines file descriptor 2 into file descriptor 1. When preceded by >, both standard output and standard errors are captured in a single file (./deploy_script.sh > build.log 2>&1).
• &> (Linux Bash shorthand): Directs both stdout and stderr simultaneously to a destination file (./deploy_script.sh &> build.log).

The Pipe Operator (|)

The pipe operator connects the stdout of the preceding command directly to the stdin of the succeeding command in a concurrent processing chain.

# Linux pipeline: List all processes, filter for apache2, sort by RAM usage, view top 5
ps aux | grep '[a]pache2' | sort -k 4 -nr | head -n 5

# PowerShell pipeline: Query services, filter for stopped automatic services, restart them
Get-Service | Where-Object { $_.Status -eq 'Stopped' -and $_.StartType -eq 'Automatic' } | Start-Service -Verbose