Operating Systems Theory — Glossary¶

Here’s some vibe code slop I made to review stuff: https://claude.ai/artifact/9cxv7rqrrxXGqSoxYiJNHo

Core Concepts¶

Operating System (OS): Software that manages hardware and provides services for programs; sits between hardware and applications.
Kernel: The core of the OS; manages CPU, memory, and devices. Always resident in memory.
Kernel Mode vs. User Mode: Kernel mode has unrestricted hardware access (rings/privilege levels); user mode is restricted and must go through the kernel for privileged operations.
System Call: The interface a program uses to request a service from the kernel (e.g., file I/O, process creation).
Shell: A user interface (CLI or GUI) for interacting with the OS.
Firmware / BIOS / UEFI: Low-level software stored on hardware that initializes the machine and loads the bootloader before the OS starts.
Bootloader: Small program that loads the OS kernel into memory at startup.
Multiprogramming: Multiple programs reside in memory at once so the CPU always has something to run, maximizing CPU utilization.
Multitasking: The OS rapidly switches between processes to give the appearance of simultaneous execution.
Multiprocessing: A system with more than one physical CPU/core.
Time-Sharing: Rapid switching between users/processes so each gets a slice of CPU time, giving the illusion of concurrent, interactive use.
Batch Processing: Jobs are collected and run without user interaction, one after another.
Real-Time OS (RTOS): An OS with guaranteed response times for time-critical tasks (hard vs. soft real-time).

Processes and Threads¶

Process

A program in execution; has its own memory space, resources, and execution state.

Process Control Block (PCB)

Kernel data structure holding a process’s state, PID, registers, memory info, and scheduling info.

Process States

New Process — being created
Ready (Process State) — waiting for CPU time
Running (Process State) — currently executing
Waiting/Blocked (Process State) — waiting on I/O or an event
Terminated Process — finished execution

Context Switch

Saving the state of one process/thread and loading another so the CPU can switch between them.

Thread

A unit of execution within a process; threads share the process’s memory but have their own stack and registers.

Process vs. Thread

Processes are isolated and heavyweight (separate memory); threads within a process share memory and are lighter weight.

PID (Process ID)

Unique identifier assigned to a process.

Fork / Exec

fork creates a copy of the current process (child); exec replaces a process’s memory image with a new program.

Zombie Process

A terminated process whose exit status hasn’t been read by its parent yet; still has a PCB entry.

Orphan Process

A process whose parent has terminated; usually adopted by an init process.

Daemon

A background process with no controlling terminal, typically providing a service (e.g., a web server).

CPU Scheduling¶

Scheduler

Decides which process/thread runs next.

Long-term scheduler — decides which jobs enter the system.
Short-term scheduler (CPU scheduler) — decides which ready process gets the CPU next.
Medium-term scheduler — handles swapping processes in/out of memory.

Dispatcher

Performs the actual context switch to hand the CPU to the process chosen by the scheduler.

Preemptive vs. Non-Preemptive Scheduling

Preemptive: the OS can interrupt a running process. Non-preemptive: a process keeps the CPU until it finishes or blocks voluntarily.

Scheduling Algorithms

FCFS (First-Come, First-Served) — runs jobs in arrival order.
SJF (Shortest Job First) — runs the shortest job next; can be preemptive (Shortest Remaining Time First).
Round Robin — each process gets a fixed time quantum, then moves to the back of the queue.
Priority Scheduling — runs the highest-priority process first.
Multilevel Queue — separate queues for different process types (e.g., interactive vs. batch), each with its own algorithm.
Multilevel Feedback Queue — processes move between queues based on behavior/history.

Time Quantum

The fixed time slice a process gets before being preempted (Round Robin).

Turnaround Time

Total time from process submission to completion.

Waiting Time

Total time a process spends in the ready queue.

Response Time

Time from submission until the first response/output.

Throughput

Number of processes completed per unit time.

Starvation

A process never gets the resources/CPU time it needs because others keep getting priority.

Aging

Gradually increasing the priority of a waiting process to prevent starvation.

Process Synchronization & Concurrency¶

Race Condition

Outcome depends on the unpredictable timing/order of concurrent operations on shared data.

Critical Section

The part of code where a process accesses shared resources that must not be concurrently accessed by more than one process.

Mutual Exclusion

Only one process/thread may execute in the critical section at a time.

Mutex (Mutual Exclusion Lock)

A lock that only the thread holding it can release; used to protect a critical section.

Semaphore

An integer variable used for signaling between processes; incremented/decremented atomically.

Binary semaphore — behaves like a mutex (0 or 1).
Counting semaphore — controls access to a resource with multiple instances.

Monitor

A high-level synchronization construct that bundles shared data with the procedures that operate on it, ensuring mutual exclusion automatically.

Spinlock

A lock where a thread busy-waits (spins) in a loop until it becomes available, instead of sleeping.

Atomic Operation

An operation that completes fully or not at all, with no possibility of being interrupted partway through.

Deadlock

Two or more processes are each waiting on a resource held by another, so none can proceed.

Livelock

Processes keep changing state in response to each other but make no progress (unlike deadlock, they aren’t blocked, just stuck looping).

Producer-Consumer Problem

Classic synchronization problem: producers add items to a shared buffer, consumers remove them, and access must be coordinated.

Dining Philosophers Problem

Classic problem illustrating deadlock/starvation risks when processes compete for a shared set of limited resources.

Deadlocks¶

Four Necessary Conditions for Deadlock: All four must hold simultaneously for deadlock to be possible: mutual exclusion (resources can’t be shared), hold and wait (a process holds a resource while waiting for another), no preemption (resources can’t be forcibly taken away), and circular wait (a cycle of processes each waiting on the next).
Deadlock Prevention: Design the system so at least one of the four conditions can never hold.
Deadlock Avoidance: Grant resource requests only if doing so keeps the system in a “safe state” (e.g., Banker’s Algorithm).
Deadlock Detection & Recovery: Let deadlocks happen, detect them (e.g., via a resource allocation graph/cycle detection), then recover (kill a process, preempt a resource).
Banker’s Algorithm: A deadlock-avoidance algorithm that simulates resource allocation to ensure the system never enters an unsafe state.
Resource Allocation Graph: A graph of processes and resources; a cycle in it can indicate a deadlock.

Memory Management¶

Physical vs. Logical (Virtual) Address

Logical addresses are what a program uses; the MMU translates them to physical addresses in RAM.

MMU (Memory Management Unit)

Hardware that translates logical/virtual addresses to physical addresses.

Virtual Memory

Technique letting processes use more memory than physically exists by using disk as an extension of RAM.

Paging

Memory is divided into fixed-size pages (logical) and frames (physical); pages are mapped to frames via a page table.

Page Table

Data structure mapping virtual pages to physical frames for a process.

TLB (Translation Lookaside Buffer)

A cache of recent page table lookups, speeding up address translation.

Page Fault

Occurs when a process accesses a page not currently in physical memory, requiring the OS to load it from disk.

Demand Paging

Pages are loaded into memory only when needed (on a page fault), not all at once.

Segmentation

Memory is divided into variable-size logical segments (code, stack, heap, etc.) rather than fixed-size pages.

Swapping

Moving an entire process between main memory and disk to free up RAM.

Thrashing

The system spends more time swapping/paging than executing actual work, because too little physical memory is available.

Fragmentation

Internal Fragmentation — wasted space inside an allocated block (e.g., a page not fully used).
External Fragmentation — free memory is split into small, scattered chunks that can’t satisfy larger requests.

Page Replacement Algorithms

Decide which page to evict when memory is full and a new page must be loaded.

FIFO (Page Replacement) — evict the oldest loaded page.
LRU (Least Recently Used) — evict the page unused for the longest time.
Optimal (Page Replacement) — evict the page not needed for the longest future time (theoretical benchmark).
Clock (Second-Chance) — approximates LRU cheaply using a circular buffer and reference bits.

Working Set

The set of pages a process is actively using in a given time window.

File Systems¶

File: A named collection of related data stored persistently.
Directory: A structure that organizes files, mapping names to file locations.
inode: A data structure (Unix/Linux) storing a file’s metadata (size, permissions, timestamps, pointers to data blocks) — not its name.
File Allocation Table (FAT): An older file system that tracks which disk clusters belong to which file via a table.
NTFS / ext4: Modern journaling file systems for Windows and Linux respectively.
Journaling: A file system logs changes before committing them, so it can recover cleanly after a crash.
Mount Point: A location in the directory tree where a separate file system/volume is attached.
File Descriptor: An integer handle a process uses to refer to an open file/socket/ pipe.
Metadata: Data about data — e.g., a file’s size, owner, permissions, and timestamps.
Permissions (rwx): Read/write/execute flags controlling what owner, group, and others can do with a file (Unix-style).
ACL (Access Control List): A more granular permissions model listing specific users/groups and their allowed actions on a resource.

I/O and Devices¶

Device Driver: Software that lets the OS communicate with a specific hardware device.
Interrupt: A signal to the CPU that stops normal execution so it can handle an urgent event (e.g., a keypress or completed disk read).
Interrupt Handler (ISR): The routine the CPU runs in response to an interrupt.
Polling: The CPU repeatedly checks a device’s status instead of waiting for an interrupt — simpler but wastes CPU cycles.
DMA (Direct Memory Access): Lets devices transfer data to/from memory directly, without involving the CPU for every byte.
Buffering: Temporarily storing data in memory while it’s transferred between two devices/processes at different speeds.
Spooling: Queuing jobs (e.g., print jobs) to a buffer/disk so a device can process them one at a time without blocking the requesting process.

Security & Protection¶

Authentication: Verifying who a user/process is (e.g., password, key).
Authorization: Determining what an authenticated user/process is allowed to do.
Privilege Levels / Protection Rings: Hierarchical CPU modes (e.g., Ring 0 = kernel, Ring 3 = user) that restrict what code can do.
Principle of Least Privilege: Give a process/user only the access needed to do its job, no more.
Sandboxing: Running a program in a restricted environment to limit what it can access or affect.

Users, Groups & Permissions¶

UID (User ID)

The number the kernel uses to identify an account. Every process carries the UID of the account that started it (e.g., your account is usually UID 1000).

root

The superuser account, UID 0. The kernel skips permission checks for root, so it can read or change anything.

sudo

Runs a single command as root (or, with -u, as another user); only accounts allowed to use it can do admin tasks.

Group

A named set of accounts. Giving a group access to a file lets every member use it — the usual way to share files between accounts.

Owner / Group / Others

Every file has an owner and a group, plus three sets of permissions: what the owner may do, what group members may do, and what everyone else may do.

Permission String (ls -l)

The 10 characters at the start of an ls -l line, e.g. -rw-r-----: 1st = type (- file, d directory), then three rwx sets for owner, group, and others.

Directory Permissions

On a folder, r lets you list its contents, w lets you add or remove files, and x lets you enter it.

Octal (Numeric) Permissions

Permissions written as digits for owner/group/others, adding r = 4, w = 2, x = 1. 750 = rwx r-x ---; 640 = rw- r-- ---.

chmod

Command that changes a file’s permissions (e.g., chmod 750 ~).

chown

Command that changes a file’s owner and/or group (e.g., chown root:team /srv/team).

setgid Bit

A special permission (the s in the group slot, or a leading 2 as in 2770). On a directory, new files inside it belong to the directory’s group instead of the creator’s group.

/etc/passwd

File listing every account (name, UID, home folder, shell). Anyone can read it.

/etc/shadow

File holding the password hashes. Only root can read it.

/etc/group

File listing the groups and which accounts belong to each.

Service Account

An account a service runs as (e.g., www-data for Apache, git, tomcat), so permissions keep services out of each other’s files and out of yours.

User & Group Commands

id — shows your UID and groups.
adduser / deluser — create / remove an account.
groupadd / groupdel — create / remove a group.
usermod -aG <group> <user> — add a user to a group (takes effect at next login).
gpasswd -d <user> <group> — remove a user from a group.

Firewall & Network Security¶

Firewall: Decides which network traffic is allowed to reach (or leave) a machine.
Port: A number identifying a network service on a machine, e.g. 22 = SSH, 80 = HTTP, 443 = HTTPS.
Default Deny: Firewall policy of blocking all incoming traffic, then allowing only the ports you need (ufw default deny incoming).
netfilter: The packet filter inside the Linux kernel that actually does the filtering.
nftables: The modern rule format/tool for netfilter — the rules UFW writes for you.
UFW (Uncomplicated Firewall): A simple front-end program that writes netfilter rules for you (ufw allow 22/tcp, ufw enable, ufw status verbose).
Lockout: Enabling a firewall before allowing SSH blocks your own login; the only way back in is the VNC console.
Brute-Force Attack: Repeatedly guessing passwords/keys until one works — the reason SSH needs extra protection, since its port must stay open.
Fail2ban: A service that watches login logs and asks the firewall to ban any IP address that fails to log in too many times.
Jail (Fail2ban): A Fail2ban rule set for one service (e.g., [sshd]) with settings like maxretry (failures allowed) and bantime (ban length).
jail.conf vs. jail.local: jail.conf is the default config and gets overwritten on update; your own settings go in jail.local.
Key-Only Login: Configuring SSH to accept only key pairs, not passwords — makes brute-force password guessing useless.
systemctl: Command to control services (daemons): enable --now starts one and sets it to start at boot; restart reloads it.

Security Updates & Packages¶

Package: A bundle of software (program files plus info about what else it needs) that Debian installs, updates, and removes as one unit.
apt: Debian’s package manager; fetches and installs packages from the sources listed in /etc/apt/.
Package Sources (/etc/apt/): The list of servers apt downloads packages from, including Debian’s security source.
apt update: Only refreshes the list of what packages/versions are available; installs nothing.
apt upgrade: Installs newer versions of installed packages, but never adds or removes a package, so some updates can be left behind.
apt full-upgrade: Installs all available updates, and may add or remove packages when an update needs it.
apt list –upgradable: Shows which installed packages have newer versions available.
Security Update (Patch): A fix for a security hole. Once released, the hole is public, so a server that never updates stays vulnerable to a known attack.
unattended-upgrades: A service that runs apt on a timer every day and installs security fixes automatically, without waiting for you.
dpkg-reconfigure: Re-runs a package’s setup questions (e.g., to switch on automatic updates).
20auto-upgrades: Config file in /etc/apt/apt.conf.d/ with two lines ending in "1" — refresh the list daily and install updates daily.
Dry Run: A trial run that shows what a command would do without actually doing it (e.g., unattended-upgrade --dry-run).
systemd: The first process started at boot (PID 1); it starts services, keeps logs, and runs timers.
systemd Timer: A systemd scheduled job, like a built-in cron; list them with systemctl list-timers.
apt-daily / apt-daily-upgrade: The two timers behind automatic updates: the first refreshes the package list, the second installs the updates.
journald: The systemd logging service; stores logs in /var/log/journal/.
timesyncd: The systemd service that keeps the system clock correct.
/var/run/reboot-required: A file that exists only when an installed update needs a reboot to take effect. If ls says “No such file”, no reboot is needed.
Kernel Update Reboot: A kernel fix only takes effect after a reboot, and automatic updates never reboot on their own — check weekly and reboot by hand.
Outgoing Traffic (Updates): Updates are the one step where the server reaches out on its own to Debian’s servers, which is why the firewall allows all outgoing traffic.

Git Server¶

git Server: A server that stores git repositories so you can push to and clone from it. It needs no new port: git travels over the SSH door that is already open.
Repository (Repo): A project folder tracked by git, holding the files plus their full history of commits.
Bare Repository: A repository with no working files checked out, only the history. Servers keep bare repos (e.g. practice.git) because nobody edits files there directly.
git Account: A service account named git that owns the repositories in /srv/git. Pushes log in as git, so the kernel’s file permissions keep other accounts out.
git-shell: A restricted shell that only accepts git’s own commands (push, pull, clone). Logging in as git with it can never get a command line.
Restricted Shell: A login shell that only allows a limited set of commands, so an account can do its one job but never get a normal command line.
System Account (adduser –system): An account made for a service rather than a person (adduser –system); it gets a low UID and no normal login.
/srv/git: The git account’s home folder, where the bare repositories live (e.g. /srv/git/practice.git).
sshd: The SSH server daemon. On a push it checks your key against the git account’s authorized_keys, then starts git-shell as git for that one connection.
authorized_keys: File in an account’s ~/.ssh/ listing the public keys allowed to log in as that account. Copying yours to /srv/git/.ssh/ lets your key push as git.
.ssh Permissions (700 / 600): The .ssh folder must be drwx—— (700) and authorized_keys -rw——- (600), owned by the account. SSH refuses a key another account could change.
getent passwd: Shows an account’s line from the user database (e.g. getent passwd git ends in /srv/git:/usr/bin/git-shell).
sudo -u git: Runs one command as the git account instead of root, e.g. sudo -u git git init –bare … so the new repo is owned by git.
git init –bare -b main: Creates a new empty bare repository whose default branch is main. Each new repo on the server is this command again with a new name.
Remote (origin): A named link from your local repo to a repo somewhere else; origin is the usual name. Added with git remote add origin git@<server>:/srv/git/practice.git.
git push -u origin main: Uploads your local main branch’s commits to the remote; -u remembers origin/main so later pushes are just git push.
git clone: Copies a remote repository, with its full history, into a new local folder.
Commit: A saved snapshot of staged changes with a message (git add, then git commit -m “…”); git log –oneline lists them.
“Interactive git shell is not enabled”: The message ssh git@<server> prints before closing: proof your key works and git-shell is refusing everything that is not git.

Virtualization¶

Hypervisor

Software that creates and manages virtual machines.

Hypervisor Type 1 (bare-metal) — runs directly on hardware (e.g., ESXi, Hyper-V).
Hypervisor Type 2 (hosted) — runs on top of a host OS (e.g., VirtualBox, VMware Workstation).

Virtual Machine (VM)

An emulated computer running its own guest OS on top of a hypervisor.

Container

A lightweight, isolated environment that shares the host OS kernel (e.g., Docker) rather than virtualizing an entire OS.

Host OS / Guest OS

The host is the underlying physical machine’s OS; the guest is the OS running inside a VM.

Hosting & Remote Access¶

Dedicated Server: A physical server rented/owned by a single customer; no sharing of hardware resources with other tenants.
VPS (Virtual Private Server): A virtual machine sold as a hosting product — one physical server is partitioned (via a hypervisor) into several VPS instances, each with its own OS, root access, and guaranteed resource slice, but still sharing the underlying hardware with other tenants.
VDS (Virtual Dedicated Server): Similar to a VPS but with resources (CPU, RAM, disk) statically reserved rather than shared/overcommitted, giving more predictable, dedicated-like performance while still being a VM.
Shared Hosting: Multiple customers’ websites/accounts run on one server sharing the same OS and resource pool — cheapest option, least isolation and control.
VPS Auto Backup: A hosting provider feature that automatically snapshots/backs up a VPS on a schedule (e.g., daily/weekly), so it can be restored to a previous state if something breaks or data is lost.
Snapshot: A point-in-time image of a VM/VPS’s disk and state, used for backup or quick rollback.
VNC (Virtual Network Computing): A protocol/tool for remotely viewing and controlling another computer’s graphical desktop over a network.
RDP (Remote Desktop Protocol): Microsoft’s protocol for remotely accessing a Windows machine’s desktop, similar in purpose to VNC.
SSH (Secure Shell): An encrypted protocol used to remotely log in to and manage a server’s command line.
MAC Address (Media Access Control Address): A unique hardware identifier burned into a network interface card (NIC), used for communication on a local network (Layer 2), as opposed to an IP address (Layer 3).
Uptime: The percentage/amount of time a server or service is running and available, often used as an SLA metric for hosting providers.
Bare-Metal Server: A physical server provisioned for a single customer with no hypervisor layer — effectively another term for a dedicated server, often used in cloud contexts (e.g., “bare-metal cloud instance”).
Ping: A network utility that sends ICMP Echo Request packets to a host and waits for Echo Replies, used to check if the host is reachable and measure round-trip latency (in ms). Like a bat, or a dolphin.