Skip to content

Glossary

One-line definitions of the Linux terms used across this folder. Each entry links to the topic that explains it in full.

A to D

Term Definition
ACL Access control list: per-user and per-group permissions beyond the owner, group and other bits. See ACL.
Ambient capability A capability an executable keeps across execve without a file capability, used to run a service without full root. See Capabilities.
AppArmor A path-based Linux Security Module, the default confinement on Ubuntu. See AppArmor.
Backporting Applying a security fix to an older package version while keeping its version number, common on RHEL. See Compliance and Integrity.
Bind mount Mounting an existing directory at a second path so both show the same files. See Mounting and fstab.
Capability One slice of root's power (for example CAP_NET_BIND_SERVICE), granted to a process or file instead of full root. See Capabilities.
cgroup Control group: a kernel feature that limits and accounts CPU, memory and I/O for a set of processes. See Cgroups.
chroot Running a process with a different root directory, an early form of filesystem isolation. See Overlayfs and chroot.
COW Copy-on-write: sharing a memory page or filesystem block until one side writes, then copying it. See Process Lifecycle.
Daemon A long-running background process, usually started by systemd and detached from a terminal. See Process Lifecycle.
Demand paging Loading a page of memory from disk only when it is first accessed. See Virtual Memory.
DORA The DHCP handshake: Discover, Offer, Request, Acknowledge, by which a client leases an address. See Interfaces and Addresses.
D state Uninterruptible sleep: a process waiting on I/O that cannot be killed until the wait ends. See Process States.

E to L

Term Definition
ELF Executable and Linkable Format: the binary format of Linux programs and shared libraries. See Shared Libraries.
Ephemeral port A short-lived source port the kernel assigns to an outgoing connection. See Sockets and TCP States.
fd File descriptor: a small integer a process uses to refer to an open file, socket or pipe. See File Descriptors.
FHS Filesystem Hierarchy Standard: the agreed meaning of /etc, /var, /usr and the rest. See Filesystem Hierarchy.
fork The system call that creates a new process by duplicating the caller. See Process Lifecycle.
GID Group ID: the numeric identifier of a group. See Groups.
GPT GUID Partition Table: the modern partition scheme that replaces MBR. See Partitioning.
Hard link A second directory entry pointing at the same inode as an existing file. See Inodes and Links.
initramfs A temporary root filesystem the kernel uses early in boot to find and mount the real root. See Boot Process.
inode The on-disk structure holding a file's metadata and block pointers, but not its name. See Inodes and Links.
IQN iSCSI Qualified Name: the identifier of an iSCSI target or initiator. See iSCSI and NBD.
Journaling A filesystem technique that records pending changes so a crash leaves the filesystem consistent. See Filesystems.
Kernel space The privileged execution mode where the kernel runs, separate from user space. See Architecture.
LSM Linux Security Module: the kernel framework that SELinux and AppArmor plug into. See SELinux.
LUKS Linux Unified Key Setup: the standard for block-device encryption. See RAID and Encryption.
LVM Logical Volume Manager: an abstraction over disks that allows flexible, resizable volumes. See LVM.

M to R

Term Definition
MBR Master Boot Record: the legacy partition scheme, limited to 2 TiB and four primary partitions. See Partitioning.
mmap Mapping a file or anonymous memory into a process address space. See Virtual Memory.
Namespace A kernel feature that gives a process its own view of a resource such as PIDs, mounts or the network. See Namespaces.
netfilter The kernel packet-filtering framework behind nftables and iptables. See nftables and iptables.
NFS Network File System: a protocol for mounting a remote directory as a local filesystem. See NFS.
OOM killer The kernel routine that kills a process when memory is exhausted. See Memory.
Orphan A process whose parent has exited, reparented to PID 1. See Process States.
Overcommit The kernel granting more virtual memory than physically exists, on the bet that not all is used. See Virtual Memory.
overlayfs A union filesystem that stacks a writable layer over read-only layers, the basis of container images. See Overlayfs and chroot.
PAM Pluggable Authentication Modules: the stack that decides how logins authenticate. See PAM.
Page cache Kernel memory holding recently read file data, counted as buff/cache in free. See Virtual Memory.
PID Process ID: the numeric identifier of a running process. See Process Fundamentals.
PID 1 The first process, init or systemd, which adopts orphans and reaps them. See Process Fundamentals.
PV, VG, LV Physical volume, volume group and logical volume: the three LVM layers. See LVM.
Reaping A parent collecting a dead child's exit status with wait, clearing the zombie. See Process Lifecycle.
RSS Resident set size: the physical memory a process currently occupies. See Virtual Memory.

S to Z

Term Definition
SELinux Security-Enhanced Linux: a label-based mandatory access control system, enforcing by default on RHEL. See SELinux.
setgid A permission bit that runs a file with its group, or makes new files in a directory inherit the group. See Special Permissions.
setuid A permission bit that runs a file with the owner's identity rather than the caller's. See Special Permissions.
Signal An asynchronous notification sent to a process, such as SIGTERM or SIGKILL. See Signals.
Socket An endpoint for communication, over the network or between local processes. See Ports and Sockets.
Soft link A symbolic link: a small file holding the path of another file. See Inodes and Links.
Sticky bit A directory bit that lets only a file's owner delete it, used on /tmp. See Special Permissions.
subuid, subgid Ranges of host UIDs and GIDs mapped into a rootless container's user namespace. See Podman and Quadlet.
Swap Disk space used to hold memory pages when RAM is under pressure. See Swap.
Syscall System call: the interface a program uses to ask the kernel for a service. See System Calls and Tracing.
systemd The init system and service manager on modern distributions, PID 1 on boot. See systemctl.
Target A systemd unit that groups other units to reach a system state, replacing runlevels. See Init and Targets.
tmpfs A filesystem that lives in memory, used for /run and /dev/shm. See proc and sys.
UID User ID: the numeric identifier of a user account. See Users.
Unit The basic object systemd manages: a service, socket, mount, timer or target. See Unit Files.
User space The unprivileged execution mode where applications run, separate from kernel space. See Architecture.
UUID Universally unique identifier, used to name a filesystem in /etc/fstab regardless of device order. See Mounting and fstab.
veth A virtual Ethernet pair, one end in a namespace and one on a bridge, that connects containers. See Namespaces.
VSZ Virtual size: the total address space a process has mapped, most of it not resident. See Virtual Memory.
Zombie A process that has exited but whose exit status the parent has not yet reaped. See Process States.