Day 1 - What Is a Shell?

📌 Key Points

• The shell is a program that interprets the user's commands and passes them to the kernel. The name "shell" comes from the fact that it wraps around the kernel like a shell.
• Shells fall into two main families: the Bourne family (sh, ksh, bash, zsh) and the C family (csh, tcsh).
• The default shell on Linux is bash. It is short for Bourne Again SHell.
• To see the shell you are using, run echo $SHELL; the list of available shells is in /etc/shells; and the command to change it is chsh.
• A user's login shell is written in the 7th (last) field of /etc/passwd.

Where the Shell Sits

• The shell is a shell wrapped around the kernel. Users do not touch the kernel directly; they make requests through the shell.
• The shell does four main things: interpret commands, run programs, set up the environment, and run scripts.
• The shell is not part of the kernel but an ordinary application program. That is why you can swap it out.

How One Command Line Gets Executed

When you type ls -l /etc and press Enter, the following happens inside the shell, in order.

   1. Read      Receives the line you typed
   2. Split     Splits on whitespace into command (ls), option (-l), and argument (/etc)
   3. Expand    Replaces $variables, wildcards (*), and aliases with real values
   4. Look up   Checks whether it is a builtin; if not, searches PATH for an executable
   5. Execute   Creates a child process and runs that program
   6. Wait      Receives the exit status when it finishes and shows the prompt again

• Because of step 3, in ls *.txt it is the shell, not ls, that replaces * with file names. ls just receives the list of file names that has already been expanded.
• Step 4 is where builtin commands and external commands diverge.

type cd
# cd is a shell builtin
type cat
# cat is /usr/bin/cat
type ls
# ls is aliased to `ls --color=auto'

There is a reason cd is a builtin. Changing directories changes the shell's own current location, so a child process cannot do it on the shell's behalf. Even if the child moves, the parent shell stays where it was.

Branches of the Shell Family

                   Thompson shell (1971)
                          │
        ┌─────────────────┴─────────────────┐
        │                                   │
   Bourne shell (sh, 1977)            C shell (csh, 1978)
   Stephen Bourne                     Bill Joy
        │                                   │
   ┌────┴────┬──────────┐                  │
   │         │          │                  │
  ksh      bash       dash               tcsh
 (Korn)  (GNU, 1989)                    (improved)
   │         │
   └────► zsh (absorbs features of ksh, bash, tcsh)

Expect a question that tests the families. Only csh and tcsh are C family; all the others are Bourne family. It helps to remember that only the two with a "c" in their name are grouped separately.

What Each Shell Did Differently

The history of shells is easy to memorize if you read it as "who added the convenience features that earlier shells lacked." The order of appearance is sh (1977) → csh (1978) → ksh (1983) → bash (1989) → zsh (1990).

• csh was the first shell to add history, aliases, and job control. If asked "which shell first introduced this feature," the answer is csh, not bash.
• csh's weakness is that its syntax differs from sh, so scripts are not compatible. This syntax difference is the practical line between the C family and the Bourne family.
• ksh kept sh syntax while bringing in csh's convenience features, and bash added ksh's strengths on top of that. That is why bash became the standard.
• The default prompt also follows the family. The Bourne family uses $, the C family uses %, and in either one root gets #.

ls -l /bin/sh
# lrwxrwxrwx. 1 root root 4 ... /bin/sh -> bash     ← Red Hat family
# lrwxrwxrwx  1 root root 4 ... /bin/sh -> dash     ← Debian/Ubuntu

Modern Linux has no real Bourne shell. /bin/sh is a symbolic link to another shell. The Red Hat family points it at bash, and the Debian family points it at the lightweight dash. That is why dash is listed as "scripts only" in the table.

Creators and Names

The Level 2 exam asks directly who created each shell.

• ksh comes from Korn's name, csh from the C language, and bash from Bourne Again (a reborn Bourne).
• The name bash is a pun, since it sounds like "born again."

Which Shell Are You Using?

echo $SHELL          # /bin/bash   ← login shell
echo $0              # -bash       ← the shell currently running
cat /etc/shells      # list of shells available on this system
which bash           # /usr/bin/bash

$SHELL and $0 can differ. If you logged in with bash but then ran zsh inside it, $SHELL is still /bin/bash while $0 becomes zsh.

Checking It Yourself

cat /etc/shells
# /bin/sh
# /bin/bash
# /usr/bin/sh
# /usr/bin/bash
# /bin/tcsh
# /bin/zsh
 
grep "^user:" /etc/passwd
# user:x:1000:1000:Test User:/home/user:/bin/bash
 
ps -p $$
#     PID TTY          TIME CMD
#    2314 pts/0    00:00:00 bash

• /etc/shells lists shells as absolute paths, one per line. The list varies depending on which shells are installed.
• $$ is the PID of the current shell. That makes ps -p $$ the most reliable way to check "which shell is running right now."
• If the result of echo $0 starts with a hyphen, like -bash, it marks a login shell. A shell launched again from inside it shows up as bash without the hyphen.
• $SHELL is just a variable filled in at login from the /etc/passwd value. It does not change on its own when you run another shell.

Changing the Shell

chsh -s /bin/zsh          # set my login shell to zsh
chsh -s /bin/zsh alice    # set alice's login shell (root privileges)
chsh -l                   # list available shells

• chsh (change shell) edits the last field of /etc/passwd. It takes effect from the next login.
• You can only change to a shell registered in /etc/shells.
• For accounts that should not be allowed to log in, give /sbin/nologin or /bin/false as the shell. This keeps the account but blocks logins.

   user:x:1000:1000:Test User:/home/user:/bin/bash
                                            └─┬─┘
                                              └── 7th field = login shell

Three Ways to Change It

chsh -s /bin/zsh
# Changing shell for user.
# Password:
# Shell changed.
echo $SHELL
# /bin/bash        ← still unchanged. You must log in again for it to change
grep "^user:" /etc/passwd
# user:x:1000:1000:Test User:/home/user:/bin/zsh

• The file changes immediately, but the current shell stays the same. chsh does not touch the running shell; it only edits the value to be used at the next login.
• If you just want to try one out briefly, simply run zsh. When you exit, you return to the original shell and /etc/passwd is unchanged.
• chsh -l is supported on the Red Hat family. The Debian family's chsh does not have this option, so use cat /etc/shells instead.
• To set the shell from the time you create the account, write it like useradd -s /bin/zsh alice.

Shells That Block Login

grep nologin /etc/passwd | head -3
# bin:x:1:1:bin:/bin:/sbin/nologin
# daemon:x:2:2:daemon:/sbin:/sbin/nologin
# apache:x:48:48:Apache:/usr/share/httpd:/sbin/nologin

• These accounts are system accounts used by services, not people. They only serve as the owner of a program, so there is no reason for them to log in.
• This is different from deleting the account (userdel). The account and file ownership stay as they are, and only the login is blocked.
• On the Debian family the path is /usr/sbin/nologin.

Login Shells and Non-Login Shells

• This distinction changes which configuration files are read. The detailed order is covered three days from now.
• The difference between su and su - shows up here too. Adding the hyphen starts a login shell.

Tomorrow we cover the values the shell remembers: shell variables and environment variables.

📖 Glossary

• Shell : A program that interprets the user's commands and passes them to the kernel. The shell wrapped around the kernel.
• Bourne family : The shells that branched off from sh. ksh, bash, zsh, and dash belong here.
• C family : The shells that branched off from csh. Only two: csh and tcsh.
• bash : Bourne Again SHell. A GNU shell created by Brian Fox and the default shell on Linux.
• Login shell : The shell that runs at login. It is specified in the 7th field of /etc/passwd.
• /etc/shells : A file containing the list of paths of shells that can be used on the system.
• chsh : The command that changes the login shell. It takes effect from the next login.
• /sbin/nologin : A shell assigned to block logins. The account exists but cannot be connected to.