======================================
Operating Systems Theory — Glossary
======================================

Here's some vibe code slop I made to review stuff: https://claude.ai/artifact/9cxv7rqrrxXGqSoxYiJNHo

Core Concepts
==============

**Operating System (OS)**
    Software that manages hardware and provides services for programs;
    sits between hardware and applications.

**Kernel**
    The core of the OS; manages CPU, memory, and devices. Always resident
    in memory.

**Kernel Mode vs. User Mode**
    Kernel mode has unrestricted hardware access (rings/privilege
    levels); user mode is restricted and must go through the kernel for
    privileged operations.

**System Call**
    The interface a program uses to request a service from the kernel
    (e.g., file I/O, process creation).

**Shell**
    A user interface (CLI or GUI) for interacting with the OS.

**Firmware / BIOS / UEFI**
    Low-level software stored on hardware that initializes the machine
    and loads the bootloader before the OS starts.

**Bootloader**
    Small program that loads the OS kernel into memory at startup.

**Multiprogramming**
    Multiple programs reside in memory at once so the CPU always has
    something to run, maximizing CPU utilization.

**Multitasking**
    The OS rapidly switches between processes to give the appearance of
    simultaneous execution.

**Multiprocessing**
    A system with more than one physical CPU/core.

**Time-Sharing**
    Rapid switching between users/processes so each gets a slice of CPU
    time, giving the illusion of concurrent, interactive use.

**Batch Processing**
    Jobs are collected and run without user interaction, one after
    another.

**Real-Time OS (RTOS)**
    An OS with guaranteed response times for time-critical tasks (hard
    vs. soft real-time).

----

Processes and Threads
=======================

**Process**
    A program in execution; has its own memory space, resources, and
    execution state.

**Process Control Block (PCB)**
    Kernel data structure holding a process's state, PID, registers,
    memory info, and scheduling info.

**Process States**
    - **New Process** — being created
    - **Ready (Process State)** — waiting for CPU time
    - **Running (Process State)** — currently executing
    - **Waiting/Blocked (Process State)** — waiting on I/O or an event
    - **Terminated Process** — finished execution

**Context Switch**
    Saving the state of one process/thread and loading another so the
    CPU can switch between them.

**Thread**
    A unit of execution within a process; threads share the process's
    memory but have their own stack and registers.

**Process vs. Thread**
    Processes are isolated and heavyweight (separate memory); threads
    within a process share memory and are lighter weight.

**PID (Process ID)**
    Unique identifier assigned to a process.

**Fork / Exec**
    ``fork`` creates a copy of the current process (child); ``exec``
    replaces a process's memory image with a new program.

**Zombie Process**
    A terminated process whose exit status hasn't been read by its
    parent yet; still has a PCB entry.

**Orphan Process**
    A process whose parent has terminated; usually adopted by an init
    process.

**Daemon**
    A background process with no controlling terminal, typically
    providing a service (e.g., a web server).

----

CPU Scheduling
===============

**Scheduler**
    Decides which process/thread runs next.

    - **Long-term scheduler** — decides which jobs enter the system.
    - **Short-term scheduler (CPU scheduler)** — decides which ready
      process gets the CPU next.
    - **Medium-term scheduler** — handles swapping processes in/out of
      memory.

**Dispatcher**
    Performs the actual context switch to hand the CPU to the process
    chosen by the scheduler.

**Preemptive vs. Non-Preemptive Scheduling**
    Preemptive: the OS can interrupt a running process. Non-preemptive:
    a process keeps the CPU until it finishes or blocks voluntarily.

**Scheduling Algorithms**
    - **FCFS (First-Come, First-Served)** — runs jobs in arrival order.
    - **SJF (Shortest Job First)** — runs the shortest job next; can be
      preemptive (Shortest Remaining Time First).
    - **Round Robin** — each process gets a fixed time quantum, then
      moves to the back of the queue.
    - **Priority Scheduling** — runs the highest-priority process first.
    - **Multilevel Queue** — separate queues for different process types
      (e.g., interactive vs. batch), each with its own algorithm.
    - **Multilevel Feedback Queue** — processes move between queues based
      on behavior/history.

**Time Quantum**
    The fixed time slice a process gets before being preempted (Round
    Robin).

**Turnaround Time**
    Total time from process submission to completion.

**Waiting Time**
    Total time a process spends in the ready queue.

**Response Time**
    Time from submission until the first response/output.

**Throughput**
    Number of processes completed per unit time.

**Starvation**
    A process never gets the resources/CPU time it needs because others
    keep getting priority.

**Aging**
    Gradually increasing the priority of a waiting process to prevent
    starvation.

----

Process Synchronization & Concurrency
========================================

**Race Condition**
    Outcome depends on the unpredictable timing/order of concurrent
    operations on shared data.

**Critical Section**
    The part of code where a process accesses shared resources that must
    not be concurrently accessed by more than one process.

**Mutual Exclusion**
    Only one process/thread may execute in the critical section at a
    time.

**Mutex (Mutual Exclusion Lock)**
    A lock that only the thread holding it can release; used to protect
    a critical section.

**Semaphore**
    An integer variable used for signaling between processes;
    incremented/decremented atomically.

    - **Binary semaphore** — behaves like a mutex (0 or 1).
    - **Counting semaphore** — controls access to a resource with
      multiple instances.

**Monitor**
    A high-level synchronization construct that bundles shared data with
    the procedures that operate on it, ensuring mutual exclusion
    automatically.

**Spinlock**
    A lock where a thread busy-waits (spins) in a loop until it becomes
    available, instead of sleeping.

**Atomic Operation**
    An operation that completes fully or not at all, with no possibility
    of being interrupted partway through.

**Deadlock**
    Two or more processes are each waiting on a resource held by another,
    so none can proceed.

**Livelock**
    Processes keep changing state in response to each other but make no
    progress (unlike deadlock, they aren't blocked, just stuck looping).

**Producer-Consumer Problem**
    Classic synchronization problem: producers add items to a shared
    buffer, consumers remove them, and access must be coordinated.

**Dining Philosophers Problem**
    Classic problem illustrating deadlock/starvation risks when
    processes compete for a shared set of limited resources.

----

Deadlocks
==========

**Four Necessary Conditions for Deadlock**
    All four must hold simultaneously for deadlock to be possible: mutual
    exclusion (resources can't be shared), hold and wait (a process holds
    a resource while waiting for another), no preemption (resources can't
    be forcibly taken away), and circular wait (a cycle of processes each
    waiting on the next).

**Deadlock Prevention**
    Design the system so at least one of the four conditions can never
    hold.

**Deadlock Avoidance**
    Grant resource requests only if doing so keeps the system in a
    "safe state" (e.g., Banker's Algorithm).

**Deadlock Detection & Recovery**
    Let deadlocks happen, detect them (e.g., via a resource allocation
    graph/cycle detection), then recover (kill a process, preempt a
    resource).

**Banker's Algorithm**
    A deadlock-avoidance algorithm that simulates resource allocation to
    ensure the system never enters an unsafe state.

**Resource Allocation Graph**
    A graph of processes and resources; a cycle in it can indicate a
    deadlock.

----

Memory Management
===================

**Physical vs. Logical (Virtual) Address**
    Logical addresses are what a program uses; the MMU translates them
    to physical addresses in RAM.

**MMU (Memory Management Unit)**
    Hardware that translates logical/virtual addresses to physical
    addresses.

**Virtual Memory**
    Technique letting processes use more memory than physically exists
    by using disk as an extension of RAM.

**Paging**
    Memory is divided into fixed-size **pages** (logical) and
    **frames** (physical); pages are mapped to frames via a page table.

**Page Table**
    Data structure mapping virtual pages to physical frames for a
    process.

**TLB (Translation Lookaside Buffer)**
    A cache of recent page table lookups, speeding up address
    translation.

**Page Fault**
    Occurs when a process accesses a page not currently in physical
    memory, requiring the OS to load it from disk.

**Demand Paging**
    Pages are loaded into memory only when needed (on a page fault),
    not all at once.

**Segmentation**
    Memory is divided into variable-size logical segments (code, stack,
    heap, etc.) rather than fixed-size pages.

**Swapping**
    Moving an entire process between main memory and disk to free up
    RAM.

**Thrashing**
    The system spends more time swapping/paging than executing actual
    work, because too little physical memory is available.

**Fragmentation**
    - **Internal Fragmentation** — wasted space inside an allocated block
      (e.g., a page not fully used).
    - **External Fragmentation** — free memory is split into small,
      scattered chunks that can't satisfy larger requests.

**Page Replacement Algorithms**
    Decide which page to evict when memory is full and a new page must
    be loaded.

    - **FIFO (Page Replacement)** — evict the oldest loaded page.
    - **LRU (Least Recently Used)** — evict the page unused for the
      longest time.
    - **Optimal (Page Replacement)** — evict the page not needed for the
      longest future time (theoretical benchmark).
    - **Clock (Second-Chance)** — approximates LRU cheaply using a
      circular buffer and reference bits.

**Working Set**
    The set of pages a process is actively using in a given time
    window.

----

File Systems
=============

**File**
    A named collection of related data stored persistently.

**Directory**
    A structure that organizes files, mapping names to file locations.

**inode**
    A data structure (Unix/Linux) storing a file's metadata (size,
    permissions, timestamps, pointers to data blocks) — not its name.

**File Allocation Table (FAT)**
    An older file system that tracks which disk clusters belong to which
    file via a table.

**NTFS / ext4**
    Modern journaling file systems for Windows and Linux respectively.

**Journaling**
    A file system logs changes before committing them, so it can recover
    cleanly after a crash.

**Mount Point**
    A location in the directory tree where a separate file system/volume
    is attached.

**File Descriptor**
    An integer handle a process uses to refer to an open file/socket/
    pipe.

**Metadata**
    Data about data — e.g., a file's size, owner, permissions, and
    timestamps.

**Permissions (rwx)**
    Read/write/execute flags controlling what owner, group, and others
    can do with a file (Unix-style).

**ACL (Access Control List)**
    A more granular permissions model listing specific users/groups and
    their allowed actions on a resource.

----

I/O and Devices
=================

**Device Driver**
    Software that lets the OS communicate with a specific hardware
    device.

**Interrupt**
    A signal to the CPU that stops normal execution so it can handle an
    urgent event (e.g., a keypress or completed disk read).

**Interrupt Handler (ISR)**
    The routine the CPU runs in response to an interrupt.

**Polling**
    The CPU repeatedly checks a device's status instead of waiting for
    an interrupt — simpler but wastes CPU cycles.

**DMA (Direct Memory Access)**
    Lets devices transfer data to/from memory directly, without
    involving the CPU for every byte.

**Buffering**
    Temporarily storing data in memory while it's transferred between
    two devices/processes at different speeds.

**Spooling**
    Queuing jobs (e.g., print jobs) to a buffer/disk so a device can
    process them one at a time without blocking the requesting process.

----

Security & Protection
========================

**Authentication**
    Verifying who a user/process is (e.g., password, key).

**Authorization**
    Determining what an authenticated user/process is allowed to do.

**Privilege Levels / Protection Rings**
    Hierarchical CPU modes (e.g., Ring 0 = kernel, Ring 3 = user) that
    restrict what code can do.

**Principle of Least Privilege**
    Give a process/user only the access needed to do its job, no more.

**Sandboxing**
    Running a program in a restricted environment to limit what it can
    access or affect.

----

Users, Groups & Permissions
=============================

**UID (User ID)**
    The number the kernel uses to identify an account. Every process
    carries the UID of the account that started it (e.g., your account
    is usually UID 1000).

**root**
    The superuser account, UID 0. The kernel skips permission checks for
    root, so it can read or change anything.

**sudo**
    Runs a single command as root (or, with ``-u``, as another user);
    only accounts allowed to use it can do admin tasks.

**Group**
    A named set of accounts. Giving a group access to a file lets every
    member use it — the usual way to share files between accounts.

**Owner / Group / Others**
    Every file has an owner and a group, plus three sets of permissions:
    what the owner may do, what group members may do, and what everyone
    else may do.

**Permission String (ls -l)**
    The 10 characters at the start of an ``ls -l`` line, e.g.
    ``-rw-r-----``: 1st = type (``-`` file, ``d`` directory), then three
    ``rwx`` sets for owner, group, and others.

**Directory Permissions**
    On a folder, ``r`` lets you list its contents, ``w`` lets you add or
    remove files, and ``x`` lets you enter it.

**Octal (Numeric) Permissions**
    Permissions written as digits for owner/group/others, adding
    ``r`` = 4, ``w`` = 2, ``x`` = 1. ``750`` = ``rwx r-x ---``;
    ``640`` = ``rw- r-- ---``.

**chmod**
    Command that changes a file's permissions (e.g., ``chmod 750 ~``).

**chown**
    Command that changes a file's owner and/or group (e.g.,
    ``chown root:team /srv/team``).

**setgid Bit**
    A special permission (the ``s`` in the group slot, or a leading
    ``2`` as in ``2770``). On a directory, new files inside it belong to
    the directory's group instead of the creator's group.

**/etc/passwd**
    File listing every account (name, UID, home folder, shell). Anyone
    can read it.

**/etc/shadow**
    File holding the password hashes. Only root can read it.

**/etc/group**
    File listing the groups and which accounts belong to each.

**Service Account**
    An account a service runs as (e.g., ``www-data`` for Apache,
    ``git``, ``tomcat``), so permissions keep services out of each
    other's files and out of yours.

**User & Group Commands**
    - ``id`` — shows your UID and groups.
    - ``adduser`` / ``deluser`` — create / remove an account.
    - ``groupadd`` / ``groupdel`` — create / remove a group.
    - ``usermod -aG <group> <user>`` — add a user to a group (takes
      effect at next login).
    - ``gpasswd -d <user> <group>`` — remove a user from a group.

----

Firewall & Network Security
==============================

**Firewall**
    Decides which network traffic is allowed to reach (or leave) a
    machine.

**Port**
    A number identifying a network service on a machine, e.g. 22 = SSH,
    80 = HTTP, 443 = HTTPS.

**Default Deny**
    Firewall policy of blocking all incoming traffic, then allowing only
    the ports you need (``ufw default deny incoming``).

**netfilter**
    The packet filter inside the Linux kernel that actually does the
    filtering.

**nftables**
    The modern rule format/tool for netfilter — the rules UFW writes for
    you.

**UFW (Uncomplicated Firewall)**
    A simple front-end program that writes netfilter rules for you
    (``ufw allow 22/tcp``, ``ufw enable``, ``ufw status verbose``).

**Lockout**
    Enabling a firewall *before* allowing SSH blocks your own login; the
    only way back in is the VNC console.

**Brute-Force Attack**
    Repeatedly guessing passwords/keys until one works — the reason SSH
    needs extra protection, since its port must stay open.

**Fail2ban**
    A service that watches login logs and asks the firewall to ban any
    IP address that fails to log in too many times.

**Jail (Fail2ban)**
    A Fail2ban rule set for one service (e.g., ``[sshd]``) with settings
    like ``maxretry`` (failures allowed) and ``bantime`` (ban length).

**jail.conf vs. jail.local**
    ``jail.conf`` is the default config and gets overwritten on update;
    your own settings go in ``jail.local``.

**Key-Only Login**
    Configuring SSH to accept only key pairs, not passwords — makes
    brute-force password guessing useless.

**systemctl**
    Command to control services (daemons): ``enable --now`` starts one
    and sets it to start at boot; ``restart`` reloads it.

----

Security Updates & Packages
==============================

**Package**
    A bundle of software (program files plus info about what else it
    needs) that Debian installs, updates, and removes as one unit.

**apt**
    Debian's package manager; fetches and installs packages from the
    sources listed in ``/etc/apt/``.

**Package Sources (/etc/apt/)**
    The list of servers apt downloads packages from, including Debian's
    security source.

**apt update**
    Only refreshes the list of what packages/versions are available;
    installs nothing.

**apt upgrade**
    Installs newer versions of installed packages, but never adds or
    removes a package, so some updates can be left behind.

**apt full-upgrade**
    Installs all available updates, and may add or remove packages when
    an update needs it.

**apt list --upgradable**
    Shows which installed packages have newer versions available.

**Security Update (Patch)**
    A fix for a security hole. Once released, the hole is public, so a
    server that never updates stays vulnerable to a known attack.

**unattended-upgrades**
    A service that runs apt on a timer every day and installs security
    fixes automatically, without waiting for you.

**dpkg-reconfigure**
    Re-runs a package's setup questions (e.g., to switch on automatic
    updates).

**20auto-upgrades**
    Config file in ``/etc/apt/apt.conf.d/`` with two lines ending in
    ``"1"`` — refresh the list daily and install updates daily.

**Dry Run**
    A trial run that shows what a command would do without actually
    doing it (e.g., ``unattended-upgrade --dry-run``).

**systemd**
    The first process started at boot (PID 1); it starts services,
    keeps logs, and runs timers.

**systemd Timer**
    A systemd scheduled job, like a built-in cron; list them with
    ``systemctl list-timers``.

**apt-daily / apt-daily-upgrade**
    The two timers behind automatic updates: the first refreshes the
    package list, the second installs the updates.

**journald**
    The systemd logging service; stores logs in ``/var/log/journal/``.

**timesyncd**
    The systemd service that keeps the system clock correct.

**/var/run/reboot-required**
    A file that exists only when an installed update needs a reboot to
    take effect. If ``ls`` says "No such file", no reboot is needed.

**Kernel Update Reboot**
    A kernel fix only takes effect after a reboot, and automatic updates
    never reboot on their own — check weekly and reboot by hand.

**Outgoing Traffic (Updates)**
    Updates are the one step where the server reaches out on its own to
    Debian's servers, which is why the firewall allows all outgoing
    traffic.

----

Git Server
============

**git Server**
    A server that stores git repositories so you can push to and
    clone from it. It needs no new port: git travels over the SSH
    door that is already open.

**Repository (Repo)**
    A project folder tracked by git, holding the files plus their
    full history of commits.

**Bare Repository**
    A repository with no working files checked out, only the
    history. Servers keep bare repos (e.g. practice.git) because
    nobody edits files there directly.

**git Account**
    A service account named git that owns the repositories in
    /srv/git. Pushes log in as git, so the kernel's file permissions
    keep other accounts out.

**git-shell**
    A restricted shell that only accepts git's own commands (push,
    pull, clone). Logging in as git with it can never get a command
    line.

**Restricted Shell**
    A login shell that only allows a limited set of commands, so an
    account can do its one job but never get a normal command line.

**System Account (adduser --system)**
    An account made for a service rather than a person (adduser
    --system); it gets a low UID and no normal login.

**/srv/git**
    The git account's home folder, where the bare repositories live
    (e.g. /srv/git/practice.git).

**sshd**
    The SSH server daemon. On a push it checks your key against the
    git account's authorized_keys, then starts git-shell as git for
    that one connection.

**authorized_keys**
    File in an account's ~/.ssh/ listing the public keys allowed to
    log in as that account. Copying yours to /srv/git/.ssh/ lets
    your key push as git.

**.ssh Permissions (700 / 600)**
    The .ssh folder must be drwx------ (700) and authorized_keys
    -rw------- (600), owned by the account. SSH refuses a key
    another account could change.

**getent passwd**
    Shows an account's line from the user database (e.g. getent
    passwd git ends in /srv/git:/usr/bin/git-shell).

**sudo -u git**
    Runs one command as the git account instead of root, e.g. sudo
    -u git git init --bare ... so the new repo is owned by git.

**git init --bare -b main**
    Creates a new empty bare repository whose default branch is
    main. Each new repo on the server is this command again with a
    new name.

**Remote (origin)**
    A named link from your local repo to a repo somewhere else;
    origin is the usual name. Added with git remote add origin
    git@<server>:/srv/git/practice.git.

**git push -u origin main**
    Uploads your local main branch's commits to the remote; -u
    remembers origin/main so later pushes are just git push.

**git clone**
    Copies a remote repository, with its full history, into a new
    local folder.

**Commit**
    A saved snapshot of staged changes with a message (git add, then
    git commit -m "..."); git log --oneline lists them.

**"Interactive git shell is not enabled"**
    The message ssh git@<server> prints before closing: proof your
    key works and git-shell is refusing everything that is not git.

----

Virtualization
================

**Hypervisor**
    Software that creates and manages virtual machines.

    - **Hypervisor Type 1 (bare-metal)** — runs directly on hardware
      (e.g., ESXi, Hyper-V).
    - **Hypervisor Type 2 (hosted)** — runs on top of a host OS (e.g.,
      VirtualBox, VMware Workstation).

**Virtual Machine (VM)**
    An emulated computer running its own guest OS on top of a
    hypervisor.

**Container**
    A lightweight, isolated environment that shares the host OS kernel
    (e.g., Docker) rather than virtualizing an entire OS.

**Host OS / Guest OS**
    The host is the underlying physical machine's OS; the guest is the
    OS running inside a VM.

----

Hosting & Remote Access
==========================

**Dedicated Server**
    A physical server rented/owned by a single customer; no sharing of
    hardware resources with other tenants.

**VPS (Virtual Private Server)**
    A virtual machine sold as a hosting product — one physical server is
    partitioned (via a hypervisor) into several VPS instances, each with
    its own OS, root access, and guaranteed resource slice, but still
    sharing the underlying hardware with other tenants.

**VDS (Virtual Dedicated Server)**
    Similar to a VPS but with resources (CPU, RAM, disk) statically
    reserved rather than shared/overcommitted, giving more predictable,
    dedicated-like performance while still being a VM.

**Shared Hosting**
    Multiple customers' websites/accounts run on one server sharing the
    same OS and resource pool — cheapest option, least isolation and
    control.

**VPS Auto Backup**
    A hosting provider feature that automatically snapshots/backs up a
    VPS on a schedule (e.g., daily/weekly), so it can be restored to a
    previous state if something breaks or data is lost.

**Snapshot**
    A point-in-time image of a VM/VPS's disk and state, used for backup
    or quick rollback.

**VNC (Virtual Network Computing)**
    A protocol/tool for remotely viewing and controlling another
    computer's graphical desktop over a network.

**RDP (Remote Desktop Protocol)**
    Microsoft's protocol for remotely accessing a Windows machine's
    desktop, similar in purpose to VNC.

**SSH (Secure Shell)**
    An encrypted protocol used to remotely log in to and manage a
    server's command line.

**MAC Address (Media Access Control Address)**
    A unique hardware identifier burned into a network interface card
    (NIC), used for communication on a local network (Layer 2), as
    opposed to an IP address (Layer 3).

**Uptime**
    The percentage/amount of time a server or service is running and
    available, often used as an SLA metric for hosting providers.

**Bare-Metal Server**
    A physical server provisioned for a single customer with no
    hypervisor layer — effectively another term for a dedicated server,
    often used in cloud contexts (e.g., "bare-metal cloud instance").

**Ping**
    A network utility that sends ICMP Echo Request packets to a host and
    waits for Echo Replies, used to check if the host is reachable and
    measure round-trip latency (in ms). Like a bat, or a dolphin.