Kernel vs userland — the layered model

Linux administration is easier when you can place every component in a layer. The layered model below appears — in some form — in every later lesson of this course.

The seven layers

flowchart TB
  H["Hardware<br/>CPU, RAM, disk, NIC, BMC"]
  K["Linux kernel<br/>scheduling, memory, drivers, VFS, networking, security"]
  L["System libraries<br/>glibc, libssl, libsystemd, libpam"]
  S["System services<br/>systemd, sshd, journald, chronyd, firewalld"]
  A["Shell / Applications<br/>bash, ssh, nginx, postgres"]
  U["Users"]

  H --> K
  K --> L
  L --> S
  S --> A
  A --> U
  U -.interacts via.-> A

Kernel mode vs user mode

The CPU itself distinguishes two privilege levels. The kernel runs in kernel mode with full hardware access; everything else runs in user mode with restricted access. Transitions between the two happen through a controlled mechanism: the system call interface.

sequenceDiagram
  participant U as User process (bash)
  participant K as Kernel

  U->>K: syscall: open("/var/log/syslog", O_RDONLY)
  K->>K: validate path, check permissions, locate inode
  K-->>U: return file descriptor (e.g., 3)

  U->>K: syscall: read(3, buf, 4096)
  K->>K: copy bytes from page cache into user buffer
  K-->>U: return number of bytes read

  U->>K: syscall: close(3)
  K->>K: release file descriptor
  K-->>U: return 0

A userland program cannot read a file, open a network socket, allocate memory above its current mapping, or talk to a device directly. Every such action goes through a syscall, and the kernel decides whether to honour it based on the process’s credentials, capabilities, and cgroup limits.

This is the foundation of every security boundary in Linux: capabilities, namespaces, cgroups, seccomp, and LSMs (SELinux, AppArmor) are all enforced by the kernel at the syscall layer.

$ strace -c -p $(pgrep -x systemd) 2>&1 | head -20

strace: Process 1 attached
% time     seconds  usecs/call     calls    errors syscall
------ ----------- ----------- --------- --------- ----------------
28.06    0.000044           1        36        18 futex
21.79    0.000034           1        24           epoll_wait
18.59    0.000029           1        20        12 read
12.82    0.000020           1        14           clock_gettime
6.41    0.000010           1         8           timerfd_settime
4.49    0.000007           1         5           writev
2.56    0.000004           1         3           accept4
1.92    0.000003           1         3         3 restart_syscall
1.28    0.000002           1         1           getsockname
0.64    0.000001           1         1           bpf
------ ----------- ----------- --------- --------- ----------------
100.00    0.000156                    135        33 total

PID 1 — the init process

When the Linux kernel finishes boot, it invokes a single userspace program: the init process, always PID 1. Every other process on the system is a descendant of PID 1 (directly or indirectly).

On modern Linux distributions PID 1 is systemd. PID 1 is special:

• It runs as root with all capabilities.
• The kernel will not deliver certain signals to it (notably SIGKILL and SIGSTOP) — they are silently ignored. This is by design, so a misconfigured init cannot be killed and leave the system unmanageable.
• If PID 1 dies, the kernel panics. There is no userspace fallback.

Where each subsystem lives

A common confusion is “is X in the kernel or userspace?” The rule of thumb:

• In the kernel: anything that needs to mediate access to a shared resource. Schedulers, the VFS, the network stack, cgroups, namespaces, capabilities, security modules, device drivers.
• In userspace: anything that does not need to mediate access to shared resources. The shell, the package manager, the init system, userland daemons, your applications.

The boundary is not arbitrary. Moving a function into the kernel makes it faster and harder to bypass; moving it out makes it easier to configure and replace. Production sysadmins benefit from being able to say “this lives in the kernel” or “this lives in userspace” when triaging an issue.

Knowledge check