DevOpsLinuxCommand LineFilesystem

File and Directory Operations

K
Kai··4 min read
Linux From Basics to ProficiencyPart 4 of 18
PreviousThe Filesystem and FHS: Everything Is a FileNextEditors: nano and vim

Article 2 told you where files live. This article operates on them: create, copy, move, rename, delete, link, and find files. This is the group of commands you use the most every day.

Open the lab (docker start -ai linuxlab) and work in /tmp for safety:

cd /tmp

Creating files and directories

touch a.txt b.txt        # create empty files (or update the timestamp if they exist)
mkdir proj               # create a directory
mkdir -p proj/src/utils  # -p creates the whole nested tree, no error if it already exists

touch creates an empty file; if the file already exists, it just updates the timestamp. mkdir -p is very handy: it creates any missing parent directories in one go.

Copying and moving

cp a.txt proj/           # copy a file into the proj directory
cp -r proj proj-backup   # -r (recursive) to copy a whole directory
mv b.txt proj/src/       # move a file
mv a.txt readme.txt      # rename (mv is the rename command in Linux)

Note: mv is both move and rename — Linux has no separate "rename" command. If the target is a directory, it moves; if the target is a new name in the same place, it renames.

View the directory tree to check:

ls -R proj

proj:
a.txt  src

proj/src:
b.txt

(ls -R lists recursively. The tree command gives a nicer tree view but needs installing: apt-get install -y tree.)

Deleting — and a warning

rm readme.txt            # delete a file
rm -r proj-backup        # -r deletes a directory and its contents
rmdir proj/src/utils     # only deletes an EMPTY directory

Important warning: Linux has no trash bin for the command line. rm deletes for good, no recovery. Especially dangerous is rm -rf (force, recursive, no prompt) — a mistyped path can wipe out all your data. Rule: before rm -r, run ls on that exact path to be sure of what you're deleting. And never run rm -rf / or rm -rf /*.

Wildcards: operating in bulk

The shell expands special characters (called globbing) into the list of matching files, before running the command:

  • * — matches any string (including empty)
  • ? — matches exactly one character
  • [...] — matches one character from the set
touch log1.txt log2.txt log3.txt note.md
ls log*.txt        # log1.txt log2.txt log3.txt
ls *.md            # note.md
ls log?.txt        # log1.txt log2.txt log3.txt (each ? is one character)
ls log[12].txt     # log1.txt log2.txt
rm log*.txt        # delete all log...txt files at once

Wildcards work with any command, not just ls/rm. This is how you operate on many files at once.

A symbolic link (symlink) is a "shortcut" pointing to another file/directory:

ln -s /tmp/proj/a.txt link-to-a
ls -l link-to-a

lrwxrwxrwx ... link-to-a -> /tmp/proj/a.txt

The leading l (Article 2) tells you this is a symlink. Symlinks are used a lot to point a "current version" at a specific directory, or to put a command into PATH. (There's also a hard link created with ln without -s, but symlinks are far more common.)

Finding files with find

find walks the directory tree by condition:

find /tmp/proj -name "*.txt"        # find by name
find /tmp -type d -name "proj"      # -type d: directories only (f: files)
find /tmp -name "*.log" -size +10M  # .log files larger than 10MB

/tmp/proj/a.txt
/tmp/proj/src/b.txt

find is very powerful, and can even run a command on each result with -exec:

find /tmp -name "*.tmp" -exec rm {} \;   # find and delete each .tmp file

{} is the placeholder replaced by each found filename; \; ends the command. This is a handy pattern for bulk cleanup by condition.

Quick distinction: find walks the filesystem by condition (name, type, size, time); to find the content inside files, use grep (Article 5).

🧹 Cleanup

cd /tmp && rm -rf proj proj-backup note.md link-to-a *.txt
ls /tmp

Wrap-up

You've got the core file-operation commands: touch/mkdir -p (create), cp -r/mv (copy, move, rename), rm -r/rmdir (delete — remember there's no trash bin), ln -s (link), wildcards * ? [] (bulk), and find (search by condition, with -exec). The most important safety rule: be careful with rm -rf, always ls to check a path before deleting.

You can create and move files now, but to edit the content of a file right in the terminal you need an editor. Article 4 teaches nano and vim — two editors you'll definitely run into on a server.

Linux From Basics to ProficiencyPart 4 of 18
PreviousThe Filesystem and FHS: Everything Is a FileNextEditors: nano and vim

Related Posts

LSM BPF: Enforcing Security Right Inside...
SecurityLinux

LSM BPF: Enforcing Security Right Inside the Kernel

So far our eBPF has only observed. LSM BPF enforces: it attaches to the kernel's security hooks (Linux Security Modules) that SELinux and AppArmor use, and a program returns 0 to allow or -EPERM to block. This article writes an LSM program that blocks opening a file, and hits a lesson: it loaded and attached but blocked nothing — because bpf wasn't an active LSM. After enabling bpf via a boot parameter and rebooting, it blocks for real — both cat and python get Operation not permitted.

K
KaiMay 24, 2026
Writing a tc Program Yourself: __sk_buff...
NetworkingLinux

Writing a tc Program Yourself: __sk_buff and the tcx Chain

Article 12 read Cilium's tc datapath from the outside. This article writes a tc program ourselves — counting egress packets by protocol — to understand __sk_buff from the inside. The core difference from XDP: tc sees the sk_buff with metadata already filled in (skb->protocol, skb->len), not the raw packet. We attach it with tcx on a real interface, get correct counts, then hit a lesson: attached after Cilium on the NIC it never runs, because of how the tcx chain terminates.

K
KaiMay 24, 2026