There are a lot of configuration files in /etc. Some of them are used by installed applications like samba, but is there confs that are directly looked up by the kernel? For example passwd, groups, hostname and so on? And if so which of them are directly for the kernel?

3 Answers 3


None: the kernel doesn’t read any configuration file directly. Various tools read configuration files and set things up in the kernel (e.g. sysctl) but the kernel itself doesn’t.

  • I'd even have written any file of any sort. Even kernel modules don't.
    – MC68020
    Jan 21, 2023 at 16:55
  • @MC68020 the kernel does read init off its own bat, so it’s not quite “any file of any sort”. Jan 21, 2023 at 19:55
  • Granted! I'm being pedantic! (since init's main is part of linux kernel's distribution) But… well… Stephen… strictly speaking… the kernel does not "read init off its own bat"… since only init, instanced as a process will do_execve(getname_kernel(init_filename) ;-)
    – MC68020
    Jan 21, 2023 at 21:36
  • This being a little more than a subtle nuance since… the kernel (and drivers) reading any sort of any file an any point would open the kernel to unimaginable reliability / security flows.
    – MC68020
    Jan 21, 2023 at 23:27
  • What about request_firmware then? It runs in a process context, but everything happens in kernel mode, initiated by the kernel. (As does init loading, incidentally.) Jan 22, 2023 at 8:22

A few words about the Linux kernel and its role.

By itself the kernel does literally nothing. I'm not joking. When you load it, it tries to initialize your hardware and then it tries to execute /sbin/init from the root filesystem (something which is mounted at /), that's it. There's a caveat though.

The kernel itself is a large amount of algorithms which provide API (translation of userspace calls into something which the hardware knows what to do with) for applications to work with and even then those applications don't use these APIs directly, they call them via a middle-man such as, e.g. glibc (C language APIs) or Mesa (OpenGL, Vulkan APIs).

Speaking of the caveat earlier.

The kernel can be instructed to do work via e.g. iptables, nftables to process network packets but then the kernel doesn't generate those packets, it either receives them from outside or sends them as a result of running applications requesting to send them. One minor exception is ping which sort of kinda looks like the kernel is doing work but in order for ping to work, userspace has to instruct the kernel how to configure network. When the kernel boots, there are no network protocols at all.


@Stephen Kitt already provided a good answer, but if you would like to know to which utility/package the file belons to, you can try something like this.

Debian based with deb packages:

find /etc/ -type f -exec dpkg -S {} \;

RedHat based with RPM packages:

find /etc/ -type f exec rpm -qf {} \;

Command will find all files in /etc/ directory and run a query for each file to which package the file belongs to. You will see there will be no result for kernel (or linux-image) package.

  • $ dpkg -S /etc/passwd dpkg-query: no path found matching pattern /etc/passwd Jan 21, 2023 at 17:30
  • @ptiza_v_nebe that's because that file is originally generated from /usr/share/base-passwd/passwd.master, which is from the base-passwd package
    – muru
    Jan 21, 2023 at 17:36
  • is it possible to find out where all this generated files come from? Jan 21, 2023 at 17:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .