Skip to content
UnderDunn Courses

What Is Linux?

Linux FoundationsLesson 1 of 735 minutes

We installed Ubuntu, so why are we calling it Linux?

Section titled “We installed Ubuntu, so why are we calling it Linux?”

The virtual machine setup guide asked you to install Ubuntu. The next section is called Linux Foundations. Both names describe the system you are using, but they describe different parts of it.

Before we start issuing commands, we need a useful model of what is underneath them. Otherwise, “Linux” becomes a vague word meaning everything from the desktop wallpaper to a server rack, and every explanation begins to sound like it was written by someone avoiding the question.

Let’s start at the bottom.

A computer needs an operating system

Section titled “A computer needs an operating system”

A physical computer contains a processor, memory, storage, network hardware, a display, and other devices. Those parts can perform work, but an ordinary program should not need to know how every model of disk or network adapter operates.

An operating system manages the computer’s hardware and provides common services to programs.

Suppose a text editor wants to save a file. The editor does not normally send commands directly to the physical storage device. It asks the operating system to create or update a file. The operating system checks whether the editor is allowed to do that, decides where the data belongs, asks the appropriate device driver to perform the operation, and reports whether it succeeded.

The operating system performs similar work when a program:

  • requests memory;
  • starts another program;
  • reads keyboard input;
  • draws something on the screen;
  • sends data over a network;
  • accesses a file; or
  • communicates with a hardware device.

This gives programs a reasonably consistent environment. A program can ask to open a file without containing separate disk-management code for every computer ever manufactured.

The Linux kernel

Section titled “The Linux kernel”

The central part of an operating system is called the kernel. The kernel starts early when the computer boots and remains running until the computer shuts down.

The Linux kernel manages:

  • processor time;
  • memory;
  • running programs;
  • filesystems;
  • networking;
  • hardware devices; and
  • access between programs and protected resources.

The kernel does not include the entire desktop you see after logging in. It does not include the Firefox browser, the Terminal application, the file browser, or most of the commands we will run. Those are programs that use services supplied by the kernel.

Strictly speaking, Linux is the kernel. In ordinary conversation, people also use “Linux” to refer to complete operating systems built around that kernel. Context usually makes the intended meaning clear, but knowing the distinction will prevent confusion later.

The kernel is not the whole system

Section titled “The kernel is not the whole system”

A kernel by itself does not give you a comfortable computer to use. You also need programs for logging in, managing software, editing files, displaying a desktop, and performing thousands of other jobs.

A complete collection of the Linux kernel, system utilities, libraries, applications, and configuration is called a Linux distribution, or distro.

Ubuntu is a Linux distribution. Other distributions include Debian, Fedora, Arch Linux, and openSUSE. They use the Linux kernel but make different choices about:

  • which software is installed by default;
  • how software is packaged and updated;
  • where some configuration belongs;
  • how often new versions are released; and
  • how much setup the user is expected to perform.

These systems are related, but they are not identical. A command that installs software on Ubuntu may not be the command used on Fedora. A configuration guide written for one distribution may need changes on another.

Why we are using Ubuntu

Section titled “Why we are using Ubuntu”

Ubuntu is not the only distribution suitable for vulnerability research, nor is it secretly the distribution used by all real hackers after midnight.

We are using it because it provides:

  • a straightforward graphical installer;
  • broad support in VMware, Hyper-V, and UTM;
  • a large collection of packaged development and debugging tools;
  • extensive documentation;
  • predictable long-term support releases; and
  • a large user community, which means that common problems are usually searchable.

Those traits reduce setup friction. The course should spend its difficulty budget on understanding computers, not on discovering that one student’s distribution calls a package something different.

Later, the Linux skills you learn here will transfer to other distributions. Paths, processes, permissions, shells, executable files, and the kernel do not become unrelated concepts merely because the logo changes.

Knowledge check

Question 1 of 2

What is Linux in the strict technical sense?

Kernel space and user space

Section titled “Kernel space and user space”

The kernel operates with broad control over the computer. Ordinary applications should not have that level of access.

Linux therefore separates execution into two broad regions:

  • Kernel space is where the kernel and its privileged components operate.
  • User space is where ordinary programs operate with restricted access.

Firefox, the desktop, the Terminal application, and most commands run in user space. They cannot normally reach directly into kernel memory or take control of hardware whenever they feel inspired.

When a user-space program needs a protected service, it asks the kernel. That request crosses the boundary through a controlled entry point called a system call.

We will study system calls properly later. For now, the useful model is:

User program → request to the kernel → kernel checks and performs work → result returns

For example, when a program opens a file, it requests that operation from the kernel. The kernel considers the path, permissions, current process, and filesystem before returning a result.

Programs, processes, and the desktop

Section titled “Programs, processes, and the desktop”

A program is stored code and data that can be executed. When Linux starts that program, the running instance is called a process.

You may have one Firefox program installed but several Firefox processes running. The kernel tracks those processes, assigns them processor time and memory, and limits what they may access.

The graphical desktop is also a collection of processes. Windows, menus, icons, and the application launcher are not separate from the operating system in a mystical way; they are programs presenting a convenient interface to services beneath them.

This matters because the graphical interface is not the only way to operate the system. We can ask the same system to perform work through a shell.

Terminal and shell are not the same thing

Section titled “Terminal and shell are not the same thing”

The Terminal application creates a window where text input and output can appear. Inside that window, a shell reads commands and starts programs.

Ubuntu commonly uses a shell named Bash. When you type:

Terminal window
pwd

the terminal delivers the text to the shell. The shell interprets the command and starts the pwd program or shell operation. Its output travels back through the terminal and appears on the screen.

The distinction may feel picky now. It becomes useful when we run a shell without a graphical desktop, connect to a remote machine, write shell scripts, or compare how different shells interpret the same text.

You do not need to memorize that entire path every time you type. Keep this shorter version:

Terminal = the window
Shell = the command interpreter
Command = the work you asked it to start

Knowledge check

Question 1 of 2

A program needs to read a protected file. Which component enforces access to it?

Users and administrative access

Section titled “Users and administrative access”

Linux supports multiple user accounts. Each running process has an identity, and that identity helps determine which files and operations it may access.

The account you created during Ubuntu installation is an ordinary user. It can manage files in its home directory and run normal applications without controlling the entire system.

The special administrative account is named root. Root can change protected system configuration, access nearly every file, and cause extremely efficient damage with a poorly chosen command.

Ubuntu usually lets an authorized ordinary user perform a specific administrative command through sudo. You used it while updating the VM:

Terminal window
sudo apt update

sudo does not make every later command permanently administrative. It requests elevated permission for the command that follows it, subject to the system’s configuration.

Why Linux is useful for vulnerability research

Section titled “Why Linux is useful for vulnerability research”

Linux gives us a particularly visible environment for learning how software works.

Much of the system is documented and open source. Development tools are easy to install. Process and kernel information is exposed through inspectable interfaces. Compilers, debuggers, disassemblers, tracing tools, and scripting languages fit naturally into the environment.

More importantly, Linux lets us move between layers without changing subjects:

  1. We can read a small C program.
  2. Compile it into an executable file.
  3. Run it as a process.
  4. Observe its requests to the kernel.
  5. Pause it in a debugger.
  6. Inspect its memory and machine instructions.
  7. Change its input and compare the result.

That chain is vulnerability research in miniature. Linux is not simple, but it makes many of the connections visible.

The concepts also transfer. Windows and macOS have kernels, user-space processes, filesystems, permissions, system services, executable formats, and debugging tools. Their implementations and terminology differ, but we will not be starting from zero when they become relevant.

Check the model against your VM

Section titled “Check the model against your VM”

Open Terminal and run:

Terminal window
uname -s

The expected output is:

Linux

uname reports information about the running system. The -s option asks for the kernel name.

Now run:

Terminal window
cat /etc/os-release

cat displays file contents. The output should identify Ubuntu and its version.

These commands report two different layers:

  • uname -s identifies the Linux kernel.
  • /etc/os-release identifies the Ubuntu distribution.

The model we will carry forward

Section titled “The model we will carry forward”

Your course VM is a virtual computer. Ubuntu is the Linux distribution installed on it. Ubuntu includes the Linux kernel and a large collection of user-space programs. The kernel manages resources and enforces boundaries. Applications request kernel services, often through system calls. The terminal gives you a window into a shell, which interprets the commands you type.

That is enough machinery for the next lesson. We will now examine how Linux organizes files and how the shell keeps track of your location within them.

Knowledge check

Question 1 of 3

Which statement correctly describes the course VM?

Next, we will learn how the Linux filesystem is organized and how to identify our location inside it.