/usr
installed programs and libraries/usr holds the software. Nearly every program the package manager installs lands here, along with the libraries it needs and the manual pages that describe it. It is the largest directory on most systems, and it is meant to be read, not written to, in normal use.
If a command came from a package, it lives under /usr.
Why it exists
Every directory at the top of the tree is there for a reason. This is the problem /usr solves.
Everything in /usr is the same on every machine running the same release. That makes it safe to mount read-only, or to share between machines.
Software sits here; its settings go in /etc and its changing data in /var. Replacing a program then never disturbs its configuration.
/usr/local mirrors the same layout for software you compile or install by hand, so the package manager never overwrites it.
What you find inside
Not everything, but the entries worth recognising. Each is marked as a directory, a file, a link or a device.
- bindirectoryThe commands every user can run: ls, cp, grep, ssh.
- sbindirectoryAdministration commands, mostly for root.
- libdirectoryShared libraries and kernel modules.
- sharedirectoryFiles that do not depend on the CPU: manual pages, icons, time zones.
- localdirectorySoftware installed by the administrator, outside the package manager.
- includedirectoryHeader files, needed only when compiling programs.
At the terminal
Four commands that show what this directory is doing on a real machine.
ls /usr/bin | wc -lCount the commands installed on this machine.
which lsShow the full path of a command — almost always somewhere under /usr.
du -sh /usrShow how much disk space the installed software takes.
ls /usr/local/binList the programs installed by hand rather than from a package.
Handle with care
What goes wrong here, and what someone securing or attacking the machine looks at.
A file edited or deleted by hand under /usr is overwritten or missed at the next update. Install and remove software with apt, dnf or pacman.
A program you build yourself belongs in /usr/local, where updates will not touch it and it is easy to find later.