/init during early userspace, /sbin/init, and /sbin/request-key are three files that the Linux kernel accesses (and they are all executables). Are there any other files, possibly non-executable ones, that Linux opens? Like maybe the files containing the names of the users on a system?

  • 2
    Linux operates on a lot of files. Are you asking about a particular process? – dr01 Aug 18 '15 at 12:40
  • 4
    @dr01 I'm pretty sure OP is talking about the Linux kernel itself. And only ones it does itself, not at request of e.g., a userspace program calling open(2). – derobert Aug 18 '15 at 13:05
  • @derobert Thanks, it makes more sense now. – dr01 Aug 18 '15 at 13:12
  • 1
    Why do you ask? Are you considering a non-conventional file tree? Some file paths are hardcoded inside libc.so – Basile Starynkevitch Aug 18 '15 at 16:43

In general, a Linux kernel doesn't open files on its own behalf (rather than on behalf of processes). Even /sbin/init (or the 'init' program specified on the kernel command line) is exec()ed by a process (process 1 is constructed directly from an image inside the kernel, IIRC).

At one time, kernel modules requiring firmware would directly open the firmware files, but this is no longer the case, and instead the kernel makes requests of a user-mode helper program.

If your question is about which filenames are compiled into the Linux kernel, then we see the following in the 'init' image that seeds process 1:


A recursive grep for "/ turns up quite a few hits; mostly false-positives, but worth looking through for real matches.

  • 1
    But you're splitting hairs.  The fact that process 1 is constructed from an image in the kernel is an important part of this discussion, and should not be relegated to a parenthetical note.  Process 1 is a sockpuppet for the kernel (at least up until the exec succeeds); it is acting as a proxy for the kernel.  I believe that the spirit and intent of the question is "What filesystem pathnames are hard-coded into the *nix kernel?", and /sbin/init clearly answers that question (even if the pathname is obfuscated in the embedded, pre-compiled byte code that the kernel uses to seed process 1). – G-Man Aug 18 '15 at 16:00

Regarding user names, the kernel don't need (and don't care about) them, since it is dealing only with numerical user ids (the uid 0, a.k.a. root, may have special status). See credentials(7) & capabilities(7)

Conversion from user names to user ids is done by libc functions like getpwnam(3). The libc may access files (notably /etc/passwd) for that, see nsswitch.conf(5)

Regarding opening files from inside the kernel outside of an existing process (which uses open(2)...) AFAIK the kernel is only starting few processes from /sbin/init (or else /bin/sh), /sbin/request-key, /sbin/tomoyo-init, /sbin/modprobe, /sbin/poweroff, etc... You might get the full list by using strings on the uncompressed vmlinux kernel file.

Notice also that several files paths are hardcoded in the dynamic loader (see ld-linux(8) etc...) or the standard C library (your libc.so) so practically needed for nearly all applications.

  • I think udev also has some kernel-triggered processes. – Peter Cordes Aug 18 '15 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.