Linux Filesystem Hierarchy Explained

Every file path on Linux hangs from a single tree that starts at /. Knowing which top-level directories hold configuration, logs, programs, and user data saves you from guessing—and from editing the wrong file. This guide maps the directories you actually touch, then shows how to move between them and inspect what you find. For shell syntax and quoting depth, continue with the Linux command line lesson in the RHCSA tutorial syllabus.

What Is the Linux Filesystem Hierarchy?

Linux presents one directory tree rooted at /. Whether data lives on one disk or many, users and programs navigate a single hierarchy of directories and files.

A few ideas that confuse beginners early:

• Directories versus mounted filesystems — /home might be a directory on your root disk or a separate filesystem mounted at that path. ls and cd always use the path; mount and findmnt tell you which filesystem or source is mounted at that path.
• / versus the root user — / is the top directory. The root account is a username whose home directory is /root, not /.
• Files and devices in one tree — Block devices appear as paths such as /dev/sda, and kernel interfaces appear under /proc and /sys even though they are not ordinary disk files.

Distributions follow the Filesystem Hierarchy Standard (FHS) conventions loosely. You do not need to memorize every obscure path from the specification—learn the major directories administrators use daily, then drill into subdirectories when a task requires them.

Linux Directory Structure Quick Reference

Understand the Root Directory /

/ is the anchor for every absolute path. List its immediate children to see how the distribution lays out the tree:

ls -l /

dr-xr-xr-x.   2 root root    6 Apr  2  2025 afs
lrwxrwxrwx.   1 root root    7 Apr  2  2025 bin -> usr/bin
dr-xr-xr-x.   5 root root 4096 Aug  3 11:43 boot
drwxr-xr-x.  20 root root 3420 Aug  7 22:42 dev
drwxr-xr-x. 138 root root 8192 Aug  7 22:43 etc
drwxr-xr-x.   5 root root   54 Aug  7 22:30 home
lrwxrwxrwx.   1 root root    7 Apr  2  2025 lib -> usr/lib
...
dr-xr-x---.   9 root root 4096 Aug  7 22:12 root
drwxr-xr-x.  12 root root  144 Aug  3 11:33 usr

The l at the start of a ls -l line marks a symbolic link—bin points into /usr/bin on this system. Real directories show d in the first column.

stat confirms that / itself is a directory owned by root:

stat /

File: /
  Size: 235       	Blocks: 0          IO Block: 4096   directory
Device: 253,0	Inode: 128         Links: 18
Access: (0555/dr-xr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)

Do not confuse / with /root. The latter is only the root account's home—compare paths when tasks mention "the root directory" versus "log in as root."

Configuration Files in /etc

/etc holds static configuration read by services and tools at startup or when reloaded. Formats differ per application; this section maps locations only.

Common examples on a running server:

Applications often use directories under /etc, not a single file:

ls -d /etc/ssh /etc/systemd

/etc/ssh
/etc/systemd

List a few representative files:

ls -la /etc/hosts /etc/fstab /etc/passwd

-rw-r--r--. 1 root root  615 Aug  5 19:01 /etc/fstab
-rw-r--r--. 1 root root  454 Aug  7 21:57 /etc/hosts
-rw-r--r--. 1 root root 2459 Aug  7 22:30 /etc/passwd

Editing /etc usually needs elevated privileges. Validate syntax with the tool's test mode (sshd -t, apachectl configtest) before you restart a service.

Variable Data in /var

/var stores data that changes while the system runs—logs, package caches, application databases, mail queues, and spools.

A few names from a live system illustrate the variety:

ls /var/log | head -8

audit
boot.log
boot.log-20260805
btmp
chrony
cron
cups
dnf.librepo.log

ls /var/lib | head -8

AccountsService
alsa
alternatives
authselect
bluetooth
brltty
chrony
cni

When disk use grows unexpectedly, /var/log and /var/cache are common places to inspect before you chase application bugs.

Programs and Shared Data Under /usr

/usr is the main hierarchy for installed programs, libraries, and static shared data. In FHS terms it is designed so it can be mounted read-only during normal operation; package installation and system maintenance still modify it. Separating /usr from / historically let administrators mount a shared /usr across many hosts; today it still groups user-facing software away from configuration in /etc and variable data in /var.

This RHEL host keeps thousands of user commands under /usr/bin and hundreds of admin tools under /usr/sbin:

ls /usr/bin | wc -l

1459

ls /usr/sbin | wc -l

526

/usr/local is intentionally empty or sparse on fresh installs—use it when you compile software or install tarballs outside dnf:

ls -ld /usr/local/bin

drwxr-xr-x. 2 root root 56 Aug  5 11:44 /usr/local/bin

User Data in /home and /root

Normal user accounts receive home directories under /home:

ls -la /home

drwx------.  3 demo1        demo1          78 Aug  7 22:06 demo1
drwx------. 14 golinuxcloud golinuxcloud 4096 Aug  3 11:55 golinuxcloud
drwx------.  5 student      student       106 Aug  7 22:42 student

Each home holds documents, shell history, and hidden configuration files whose names start with a dot:

ls -la /home/student/.bashrc

-rw-r--r--. 1 student student 522 Oct 29  2024 /home/student/.bashrc

The root account's home is /root, not /:

ls -la /root | head -5

dr-xr-x---.  9 root root    4096 Aug  7 22:12 .
-rw-r--r--.  1 root root 4647231 Aug  3 11:50 anaconda-tb-j5uq4yhy
-rw-------.  1 root root     100 Aug  3 11:57 .bash_history

The shell expands ~ to your home directory ($HOME). cd with no arguments also returns home in bash.

System Interfaces Under /dev, /proc, and /sys

These paths look like directories in ls, but much of what they contain is kernel-provided, not ordinary files you edit with an editor.

/dev — device nodes

Block and character devices appear as special files:

ls -l /dev/sda /dev/null /dev/tty

crw-rw-rw-. 1 root root 1, 3 Aug  7 22:42 /dev/null
brw-rw----. 1 root disk 8, 0 Aug  7 22:42 /dev/sda
crw-rw-rw-. 1 root tty  5, 0 Aug  7 22:42 /dev/tty

/dev/sda is a block device for the first SCSI/SATA disk. /dev/null discards writes. /dev/tty is the controlling terminal.

/proc — process and kernel tables

/proc is a virtual filesystem exposing live kernel data:

head -3 /proc/cpuinfo

processor	: 0
vendor_id	: GenuineIntel
cpu family	: 6

head -3 /proc/meminfo

MemTotal:        6214620 kB
MemFree:         3942832 kB
MemAvailable:    4716816 kB

Each running process has a numbered directory:

ls /proc/self | head -10

arch_status
attr
autogroup
auxv
cgroup
cmdline
comm
coredump_filter
cpu_resctrl_groups

/proc/self is a symlink to the process that issued the ls command.

/sys — sysfs device layout

/sys exposes kernel objects in a structured tree—useful for block device names and driver attributes:

ls /sys/class/block

dm-0
dm-1
sda
sda1
sda2
sda3
sdb
sr0

Treat /proc and /sys as read-mostly interfaces. You query them with cat, grep, and tools such as lscpu; you do not format or mount them like /dev/sda1.

Boot Files Under /boot

/boot holds the kernel image, initramfs archives, and bootloader configuration consumed before the main system is fully online:

ls /boot | head -8

config-6.12.0-211.42.1.el10_2.x86_64
efi
grub2
initramfs-6.12.0-211.42.1.el10_2.x86_64.img
initramfs-0-rescue-23b7a5ba4a464d768c37c2b2990e7d06.img
loader
vmlinuz-6.12.0-211.42.1.el10_2.x86_64

On this host /boot is a separate XFS filesystem mounted at /boot. For the full firmware-to-login chain, see Linux boot process explained and GRUB2 on RHEL.

Temporary and Runtime Data

Three paths sound interchangeable but serve different lifetimes:

ls -ld /tmp /var/tmp /run

drwxr-xr-x. 47 root root 1240 Aug  7 22:42 /run
drwxrwxrwt. 25 root root 4096 Aug  7 22:52 /tmp
drwxrwxrwt. 12 root root 4096 Aug  7 22:50 /var/tmp

The t in /tmp permissions marks the sticky bit—users can create files but cannot delete each other's entries in that directory.

/opt and /srv appear less often on minimal servers but matter when add-on products install under /opt or when service data is published from /srv. /mnt and /media are conventional mount points for administrator mounts and removable media.

Absolute vs Relative Paths

An absolute path starts at / and does not depend on your current directory:

/etc/ssh/sshd_config

A relative path starts from your current working directory:

sshd_config
../logs
./script.sh

Common symbols:

Examples mixing styles:

~/Documents/report.txt
../../etc/hosts

The Linux command line lesson expands quoting, tilde expansion, and tab completion—this page focuses on where paths point in the hierarchy.

Navigate Directories with cd, pwd, and ls

Start by printing where you are:

pwd

/root/golinuxcloud-static

Move with an absolute path:

cd /etc/ssh

pwd

/etc/ssh

Step up with a relative path:

cd ..

pwd

/etc

Return home:

cd ~

pwd

/root

cd - jumps back to the previous working directory—handy when you alternate between config and logs.

List entries, including hidden dotfiles:

ls -la /etc/ssh | head -6

drwxr-xr-x.   2 root root  4096 Aug  3 12:00 .
drwxr-xr-x. 138 root root  8192 Aug  7 22:43 ..
-rw-r--r--.   1 root root  3656 Aug  3 12:00 sshd_config

ls -l adds permissions, owner, and size. ls -a forces hidden names to appear—critical when you look for ~/.ssh or dotfiles in a home directory.

Inspect Files and Directories

After you arrive at a path, inspect what it is before you edit or execute.

file guesses the content type:

file /etc/ssh/sshd_config

/etc/ssh/sshd_config: ASCII text

stat reports inode metadata—type, permissions, owner, timestamps:

stat -c '%F %a %U %G %n' /etc/ssh/sshd_config

regular file 600 root root /etc/ssh/sshd_config

readlink -f resolves symlinks to a canonical absolute path:

readlink -f /etc/ssh/sshd_config

/etc/ssh/sshd_config

When a path is a symlink, ls -l shows the arrow target; readlink prints the destination directly.

Find Where Linux Stores Something

Use the right lookup tool for the question:

Resolve the sshd binary:

type sshd

sshd is /usr/sbin/sshd

whereis sshd

sshd: /usr/sbin/sshd /usr/share/man/man8/sshd.8.gz

Find a configuration file by name under /etc:

find /etc -maxdepth 2 -name 'sshd_config' 2>/dev/null

/etc/ssh/sshd_config

Identify the owning RPM package:

rpm -qf /usr/sbin/sshd

openssh-server-9.9p1-25.el10_2.x86_64

List shipped documentation:

ls /usr/share/doc/openssh* | head -5

ChangeLog
CREDITS
OVERVIEW
PROTOCOL
PROTOCOL.agent

For deep find expressions and permission-aware searches, use the dedicated find guide rather than duplicating every flag here.

Common Filesystem Navigation Mistakes

Practical Walkthrough: sshd on a Real System

Tracing one service ties the hierarchy together without turning this into a certification lab.

Executable — the server binary lives in /usr/sbin:

type sshd

sshd is /usr/sbin/sshd

Configuration — settings live under /etc/ssh/:

ls -l /etc/ssh/sshd_config

-rw-------. 1 root root 3656 Aug  3 12:00 /etc/ssh/sshd_config

Logs — authentication events on RHEL often land in /var/log/secure:

find /var/log -maxdepth 1 -name 'secure*'

/var/log/secure

Documentation — package docs under /usr/share/doc:

ls -d /usr/share/doc/openssh 2>/dev/null

/usr/share/doc/openssh

Runtime process — live state under /proc and SELinux context from ps:

ps -efZ | grep '[s]shd' | head -2

system_u:system_r:sshd_t:s0-s0:c0.c1023 root 1193      1  0 22:42 ?        00:00:00 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
system_u:system_r:sshd_session_t:s0-s0:c0.c1023 root 2218 1193  0 22:43 ?  00:00:00 sshd-session: root [priv]

The listener line shows the process type sshd_t—useful when SELinux blocks a service. Process directories under /proc/1193/ expose cmdline, limits, and file descriptors for that PID.

References

• Filesystem Hierarchy Standard (FHS) 3.0
• pathname(7)
• file-hierarchy(7) — Arch Linux filesystem hierarchy
• Red Hat Enterprise Linux 10 documentation

Summary

Linux organizes everything under a single tree starting at /. Configuration concentrates in /etc, changing runtime data in /var, programs and shared static content in /usr, and personal files in /home or /root. Virtual interfaces under /dev, /proc, and /sys expose devices and kernel state through paths that behave like files even when nothing is stored on disk like a normal document.

Absolute paths always begin with /; relative paths depend on your current working directory and symbols such as ., .., and ~. pwd, cd, and ls move and list; file, stat, and readlink tell you what a path actually is before you edit it. type, whereis, rpm -qf, and find answer where binaries, configs, logs, and documentation live—patterns you reuse on every service you administer.

Next, practice copy, move, and delete workflows in Linux file management, or return to the RHCSA tutorial syllabus. Storage layout, mounts, and LVM belong in dedicated guides—not in this hierarchy map.