packages

Overview

A package is the unit of installable software on Linux — a bundle containing a program's files plus the information the system needs to install and manage it. This lesson explains what a package is and the basic operations on them.

Learning objectives

• Define a software package and its contents.
• Distinguish package formats (.deb vs .rpm).
• Perform basic package operations.

Core concept

A package bundles everything needed to install a piece of software: the program's files, metadata (name, version, description), a list of dependencies, and often scripts to run during install/removal. Two dominant formats:

• .deb — Debian/Ubuntu family, managed by apt (and the lower-level dpkg).
• .rpm — Red Hat/Fedora family, managed by dnf (and the lower-level rpm).

The package manager uses this metadata to install, upgrade, query, and remove software cleanly.

How it works

When you install a package, the manager unpacks its files to the correct locations, records what was installed, and pulls in required dependencies. Because it tracks every managed file, it can later remove the software cleanly or upgrade it without leaving orphaned files. High-level tools (apt, dnf) handle repositories and dependencies automatically, while low-level tools (dpkg, rpm) operate on individual package files directly.

Practical example

$ sudo apt install nmap        # install a package (with dependencies) from repos
$ apt list --installed | grep nmap   # query whether/what version is installed
$ sudo apt remove nmap         # remove the package

On a Red Hat system the equivalents are sudo dnf install nmap, dnf list installed, and sudo dnf remove nmap. In both cases the manager tracks the files so removal is clean.

Cybersecurity relevance

Package operations are fundamental to both administration and assessment. Querying installed packages and versions is a key enumeration step: outdated packages may carry known vulnerabilities, so knowing exactly what is installed (and its version) helps identify risk. Installing security tools, removing unnecessary software (reducing attack surface), and understanding a system's software inventory all rely on package operations. On a target (in authorized testing), the installed-package list often reveals exploitable, unpatched software.

Common mistakes

• Confusing package formats/managers — .deb/apt vs .rpm/dnf belong to different families.
• Installing unnecessary software, needlessly enlarging the attack surface.
• Ignoring installed versions, missing outdated, vulnerable packages.

Key takeaways

• A package bundles a program's files, metadata, dependency list, and install scripts as a managed unit.
• Formats differ by family: .deb (apt/dpkg) for Debian/Ubuntu, .rpm (dnf/rpm) for Red Hat/Fedora.
• Package operations (install/query/remove) are core to administration and to security enumeration — installed packages and versions reveal potential vulnerabilities and attack surface.

Check your understanding

• What does a package contain besides the program's files?
• Why is listing a system's installed packages and their versions useful during a security assessment?