Linux Kernel & /proc

Monolithic kernel design, loadable modules, /proc and /sys filesystems, and sysctl tunables.

Overview

Overview The Linux kernel is monolithic: all core subsystems (memory management, process scheduling, filesystems, networking, device drivers) run in kernel space at the same privilege level. Unlike microkernels (where subsystems run as separate processes), this gives better performance at the cost of isolation — a kernel bug can crash the entire system.

Loadable Kernel Modules (LKM): Despite being monolithic, Linux supports dynamically loading and unloading code (modules) without rebooting. lsmod lists loaded modules (from /proc/modules), modinfo shows module details (description, parameters, dependencies), modprobe loads a module and all its dependencies (reads /lib/modules/$(uname -r)/modules.dep), rmmod unloads (fails if module is in use), insmod loads a specific .ko file without dependency handling.

/proc filesystem: A virtual filesystem exposing kernel internal state as files. Nothing is stored on disk — files are generated on-the-fly when read. Key files: /proc/cpuinfo (CPU details including flags for virtualization support), /proc/meminfo (memory breakdown), /proc/loadavg (load averages and process counts), /proc/PID/ (per-process info: /proc/PID/cmdline, /proc/PID/maps for memory map, /proc/PID/fd/ for open file descriptors, /proc/PID/status), /proc/net/tcp for TCP connections (used by ss/netstat), /proc/sys/ for tunables.

/sys filesystem (sysfs): Exposes device and driver information in a structured hierarchy. /sys/class/net/ for network interfaces, /sys/block/ for block devices.

sysctl: Reads and writes kernel parameters in /proc/sys/. sysctl -a shows all, sysctl net.ipv4.ip_forward reads one, sysctl -w net.ipv4.ip_forward=1 sets it (not persistent). Persistent in /etc/sysctl.conf or /etc/sysctl.d/*.conf, applied with sysctl -p.

Key concepts

Monolithic kernel
All subsystems run in kernel space (ring 0). Fast due to no IPC overhead between subsystems. LKMs extend functionality at runtime without recompiling.
Kernel modules (lsmod/modprobe)
lsmod: list loaded modules. modprobe name: load module + dependencies. rmmod: unload. modinfo: show module details. Persistent loading via /etc/modules.
/proc filesystem
Virtual filesystem — files are kernel data structures exposed as files. /proc/PID/ per-process. /proc/sys/ for sysctl tunables. /proc/meminfo, /proc/cpuinfo for system info.
sysctl
Tool to read/write kernel parameters in /proc/sys/. sysctl -w key=value for runtime changes. /etc/sysctl.d/*.conf for persistence. Common: net.ipv4.ip_forward, vm.swappiness, net.core.somaxconn.

When to use it

  • Tuning kernel parameters for performance or networking
  • Debugging module loading failures
  • Inspecting per-process memory maps and file descriptors
  • Understanding what hardware capabilities a system has

Interview questions

  • What is the difference between lsmod, modprobe, and insmod? When would you use each?
  • How would you tune the kernel to allow a server to handle more concurrent TCP connections?

Sign up free to read the full topic

More Linux topics

Start free on Cariara · Coding problems · System design studio