Round 4: Internals¶

Senior, SRE and production engineering loops ask what happens underneath a command: which system calls run, which kernel structures change, and why the design trades one property for another. Each question links to the topic file that answers it.

Foundations¶

Question	Answered in
When `ls` runs, how does the request cross from user space to the kernel and back?	Architecture
A container needs a kernel feature the host lacks. What happens?	Kernel vs OS vs Distro

Shell and CLI¶

Question	Answered in
What does the shell do when a command is typed and Enter is pressed?	Shell Basics
What does the kernel do when `execve` gets a text file?	Command Resolution
How does a program receive its environment, and why can't a child change the parent's?	Variables and Environment
In what order does bash expand a command line?	Quoting and Expansion
How does the shell implement `2>&1` and a pipe?	Streams and Redirection
How does a parent process learn a child's exit status?	Exit Codes and Chaining

Files and Filesystem¶

Question	Answered in
What happens to open files across `fork()` and `exec()`?	File Descriptors
What are the kernel structures behind a file descriptor?	File Descriptors
What happens on disk when `rm` runs on a file that a process still has open?	Inodes and Links
Why did distributions merge `/bin` into `/usr/bin`?	Filesystem Hierarchy

Users and Access¶

Question	Answered in
How does `sudo` get root privileges, and how does `passwd` update a root-only file?	Sudo and Su
`ls -l` prints owner names, but inodes store only UIDs. Where do the names come from?	Users
Where does a process get its group list, and why can't it see a new group?	Groups
Why do modern systems hash passwords with yescrypt instead of a fast hash?	Passwords and Aging
What is the difference between `required` and `requisite` in PAM?	PAM
Why does `/var/log/lastlog` look large on a server with three users?	Login Sessions
Why keep a local admin account when all users come from LDAP?	Centralized Identity

Permissions¶

Question	Answered in
How does `passwd` update `/etc/shadow` when a normal user runs it?	Special Permissions

Package Management¶

Question	Answered in
What happens between `execve` and `main` for a dynamically linked program?	Shared Libraries

Processes¶

Question	Answered in
Which process is created, replaced and reaped when the shell runs `ls`?	Process Lifecycle
Why does `fork()` not double memory usage?	Process Lifecycle
Why can Linux use one system call for both processes and threads?	Process Fundamentals
What happens in the kernel between `kill -TERM` and the handler running?	Signals
Why does Linux count D-state tasks in the load average?	Process States
What happens at the CPU and kernel level when a program calls `read()`?	System Calls and Tracing
Why don't time functions appear in `strace` output?	System Calls and Tracing

Systemd and Services¶

Question	Answered in
How does systemd know which processes belong to a service?	Unit Files

Networking¶

Question	Answered in
What does the kernel do between a client's `connect()` and the server's `accept()`?	Sockets and TCP States
Why does `TIME_WAIT` exist, and why does it last 60 seconds on Linux?	Sockets and TCP States
Why can a server have established connections that the application never accepted?	Sockets and TCP States

Security¶

Question	Answered in
What happens inside the kernel when nginx opens a file on an SELinux system?	SELinux
How does a service end up in its own SELinux domain?	SELinux

Boot and Recovery¶

Question	Answered in
What is the difference between a kernel oops and a kernel panic, and when does one become the other?	Kernel Panic
A panic leaves nothing in `journalctl`: how do you still capture the cause?	Kernel Panic

Performance and Troubleshooting¶

Question	Answered in
A program `malloc`s 2 GB, it succeeds, then the process is killed: explain.	Virtual Memory
What happens in the kernel when a process touches a never-accessed heap page?	Virtual Memory
How does `perf` sampling differ from `strace` tracing, and why does overhead differ?	Profiling and Tracing

Containers¶

Question	Answered in
How does a rootless container let root inside map to a normal user outside?	Namespaces
What keeps a namespace alive after the process that created it exits?	Namespaces
How does the kernel enforce a memory limit, and what happens at the cap?	Cgroups
Why can a kernel vulnerability affect every container on a host but not every VM?	Containers vs VMs

How to Answer¶

Start from the mechanism (the SUID bit, the NSS lookup, the credentials stored per process), then show the evidence (ls -l, /proc/<pid>/status).
Name the trade-off: speed against safety, caching against freshness.
Stop when the interviewer stops asking; depth on request beats a lecture.