Linux OS Basics – Part 5 – Cybersecurityworld

Processes and Packages

Processes

ps (Processes)

Processes are supporting programs for your applications that are running in the machines. These processes are only managed by the kernels and each has its own process ID (PID).

Go ahead and run the ps command to see a list of running processes:

pineturtle@DESKTOP-ESO0AIU:/tmp$ ps
  PID TTY          TIME CMD
    9 pts/0    00:00:03 bash
  934 pts/0    00:00:00 ps

This shows you a quick snapshot of the current processes:

PID: Process ID
TTY: Controlling terminal associated with the process (we’ll go into detail about this later)
STAT: Process status code
TIME: Total CPU usage time
CMD: Name of executable/command

We can also pass command options to “ps”, you can check the man page for the list of parameters.

By default, ps selects all processes with the same effective user ID (euid=EUID) as the current user and associated with the same terminal as the invoker. It displays the process ID (pid=PID), the terminal associated with the process (tname=TTY), the cumulated CPU time in [DD-]hh:mm:ss format (time=TIME), and the executable name (ucmd=CMD). Output is unsorted by default.

Try the below command and see how it outputs

ps aux

/proc filesystem

Remember everything in Linux is a file, even processes. Process information is stored in a special filesystem known as the /proc filesystem.

pineturtle@DESKTOP-ESO0AIU:/tmp$ ls /proc

You should see multiple values here, there are sub-directories for every PID. If you looked at a PID in the ps output, you would be able to find it in the /proc directory.

pineturtle@DESKTOP-ESO0AIU:/tmp$ cat /proc/3457/status

You should see process state information as well as more detailed information. The /proc directory is how the kernel views the system, so there is a lot more information here than what you would see in ps.

kill – Terminate

kill command is used to terminate a process. Use the PID of a process and pass it a parameter to the kill command.

pineturtle@DESKTOP-ESO0AIU:/tmp$ kill 3457

Packages

Package Management

Software Distributions

Your system is comprised of many packages such as internet browsers, text editors, media players, etc. These packages are managed via package managers, which install and maintain the software on your system. Not all packages are installed through package managers though, you can commonly install packages directly from their source code (we’ll get to that soon). However, the majority of the time you will use a package manager to install software, the most common variety of packages are Debian (.deb) and Red Hat (.rpm). Debian style packages are used in distributions such as Debian, Ubuntu, LinuxMint, etc. Red Hat style packages are seen in Red Hat Enterprise Linux, Fedora, CentOS, etc.

What are packages? You may know them as Chrome, Photoshop, etc and they are, but what they really are just lots and lots of files that have been compiled into one. The people (or sometimes a single person) that write this software are known as upstream providers, they compile their code and write up how to get it installed. These upstream providers work on getting out new software and updating existing software. When they are ready to release it to the world, they send their package to package maintainers, who handle getting this piece of software in the hands of the users. These package maintainers review, manage and distribute this software in the form of packages.

Package Repositories

Package repositories are a central storage location for the packages. There are lots of repositories that hold lots of packages and best of all they are all found on the internet, so no silly installation disks.

Your machine doesn’t know where to look for these repositories unless you explicitly tell it where to look.

For instance, If would want to download software, you would go to a website and then you will be downloading it. We know that the software file on that website is stored on a remote server and we know that is the source.

Now instead of going to their website to download the package directly, you can tell your machine to find that software from a source link.

Your distribution already comes with pre-approved sources to get packages from and this is how it installs all the base packages you see on your system. On a Debian system, this sources file is the /etc/apt/sources.list file. Your machine will know to look there and check for any source repositories you added.

Archive and Compressed files

You probably already know what a file archive is, you’ve most likely encountered file types such as .rar and .zip. These are an archive of files, they contain many files inside of them, but they come in this very neat single file known as an archive.

Compressing files with gzip

To compress a file down:
$ gzip myfile

To decompress the file:
$ gunzip myfile.gz

Creating archives with tar
Unfortunately, gzip can’t add multiple files into one archive for us. Luckily we have the tar program which does. When you create an archive using tar, it will have a .tar extension.

$ tar cvf tarfile.tar myfile1 myfile2

Go ahead and try the man page or –help to see what parameter can be used.

rpm and dpkg

You can use the package management commands: rpm and dpkg to install packages directly. These tools are used to install package files, however, they will not install the package dependencies, so if your package had 10 dependencies, you would have to install those packages separately and then their dependencies and so on and so forth.

In Linux, these dependencies are often other packages or shared libraries. Shared libraries are libraries of code that other programs want to use and don’t want to have to rewrite for themselves.

Install a package
Debian: $ dpkg -i some_deb_package.deb
RPM: $ rpm -i some_rpm_package.rpm

The i stands for install. You can also use the longer format of –install.

Remove a package
Debian: $ dpkg -r some_deb_package.deb
RPM: $ rpm -e some_rpm_package.rpm

Debian: r for remove
RPM: e for erase

List installed packages

Debian: $ dpkg -l
RPM: $ rpm -qa

Debian: l for list
RPM: q for query and a for all

yum and apt

Two of the most popular management systems are yum and apt. Yum is exclusive to the Red Hat family and apt is exclusive to the Debian family.

Install a package from a repository

Debian: $ apt install package_name
RPM: $ yum install package_name

Remove a package
Debian: $ apt remove package_name
RPM: $ yum erase package_name

Updating packages for a repository
It’s always best practice to update your package repositories so they are up to date before you install and update a package.

Debian: apt update; apt upgrade
RPM: yum update

Get information about an installed package

Debian: apt show package_name
RPM: yum info package_name

See you at the next part 🙂