4.1 What Linux Is and What It Does

Kali Linux Certified Professional KLCP

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 How to Use This Guide & Study Strategy 1.3 PEN-103 Syllabus & Study Path

2 About Kali Linux

2.1 A Bit of History: From BackTrack to Kali 2.2 Kali's Relationship with Debian 2.3 Purpose and Use Cases 2.4 Main Features and Design Policies

3 Getting Started with Kali Linux

3.1 Downloading and Verifying a Kali ISO 3.2 Booting Kali in Live Mode 3.3 Installation Options Overview 3.4 Troubleshooting Installations

4 Linux Fundamentals

4.1 What Linux Is and What It Does 4.2 The Command Line 4.3 The Filesystem Hierarchy Standard 4.4 Useful Commands: Files, Search, Environment

5 Permissions and Process Management

5.1 File Permissions and Ownership 5.2 Managing Processes 5.3 Shells, Variables, and the Environment

6 Installing Kali Linux

6.1 Minimal Installation Requirements 6.2 Step-by-Step Installation on a Hard Drive 6.3 Unattended Installations with Preseeding 6.4 ARM Installations

7 Configuring the Network, Users, and SSH

7.1 Configuring the Network 7.2 Managing Unix Users and Groups 7.3 Configuring SSH

8 Configuring Services

8.1 Apache Web Server 8.2 PostgreSQL Database 8.3 Managing Services with systemd

9 Helping Yourself and Getting Help

9.1 Documentation Sources 9.2 Kali Linux Communities 9.3 Filing Good Bug Reports

10 Security Policy and Network Services

10.1 Defining a Security Policy 10.2 Possible Security Measures 10.3 Securing Network Services

11 Firewalling and Monitoring

11.1 Netfilter and iptables Behavior 11.2 Writing iptables Rules and NAT 11.3 Monitoring and Logging

12 Debian Package Management: APT

12.1 Introduction to APT 12.2 The sources.list File 12.3 Kali Repositories 12.4 Basic Package Interaction with apt

13 dpkg and Advanced Package Management

13.1 dpkg Fundamentals 13.2 Inspecting .deb Files and Package State 13.3 Maintainer Scripts and Conffiles 13.4 APT Pinning and Package Authenticity

14 Advanced Usage

14.1 Modifying and Rebuilding Kali Packages 14.2 Recompiling the Kernel 14.3 Building Custom Kali Live ISO Images 14.4 USB Persistence with LUKS Encryption

15 Kali Linux in the Enterprise

15.1 Network Installation with PXE Boot 15.2 Configuration Management with SaltStack 15.3 Metapackages and Custom Repositories 15.4 Configuration Packages and Forking

16 Introduction to Security Assessments

16.1 Kali Linux in an Assessment 16.2 Types of Assessments 16.3 Types of Attacks 16.4 Formalization and the Road Ahead

4.1 What Linux Is and What It Does

Key Takeaways Explain This Topic AI

Linux is the kernel only: the bootloader loads it at boot, and everything else on the system is user-space software layered on top

The kernel's four core jobs are driving hardware, unifying filesystems (including device files under /dev), managing processes, and managing rights

Applications live in user space and cross into kernel space only through system calls, usually via the glibc wrapper library

A distribution adds an installer, package management, configuration, and applications around the kernel; Kali is a Debian-based distribution built for penetration testing

Device files under /dev come in block type (b, random access, e.g. disks) and character type (c, sequential streams, e.g. keyboards)

Last updated: July 2026

The Kernel and Its Four Core Responsibilities

Strictly speaking, Linux is only the kernel — the core program of the operating system, loaded into memory by the bootloader when the machine starts and running until shutdown. Everything else you interact with, from the zsh prompt to the Xfce desktop, is ordinary software that the kernel hosts. The exam expects you to separate these two ideas: the kernel itself, and the distribution built around it. The kernel's job breaks down into four responsibilities.

1. Driving the Hardware

The kernel is, first of all, a collection of hardware drivers . It detects and controls the machine's components — CPU, memory, disks, network cards, USB devices, displays — and presents them to the rest of the system through uniform interfaces. Driver code can be compiled directly into the kernel image or loaded on demand as kernel modules ( .ko files, managed with tools such as lsmod , modprobe , insmod , and rmmod ). This modularity is why Kali can ship a kernel patched for wireless injection while still supporting a huge range of chipsets: the injection-capable drivers are simply modules you load when you need them.

2. A Unified Filesystem Abstraction

Unix systems are famous for the idea that everything is a file , and the kernel enforces it. Whether data lives on an ext4 partition, a FAT32 USB stick, an NFS share, or a CD-ROM, the kernel's virtual filesystem layer presents all of it through one directory tree with one set of operations (open, read, write, close). The clearest expression of this is /dev , the directory of device files that represent hardware as files:

Block devices (type b in an ls -l listing) are accessed in fixed-size blocks with random access — hard disks and SSDs such as /dev/sda or /dev/nvme0n1 .

Character devices (type c ) are read or written as sequential streams of bytes — keyboards, mice, terminals, and serial ports such as /dev/ttyS0 .

Special files like /dev/null (discards anything written), /dev/zero (an endless stream of zero bytes), and /dev/random / /dev/urandom (random data from the kernel's entropy pool) are pseudo-devices provided directly by the kernel. On modern Kali, /dev is populated dynamically by udev , so entries appear and disappear as hardware is plugged in or removed.

3. Managing Processes

The kernel creates, schedules, and destroys processes . It divides CPU time among everything that is running (preemptive multitasking), allocates memory to each process, and enforces isolation so one process cannot read another's memory. The very first user-space process — on Kali, systemd — receives PID (Process Identifier) 1 , and every other process descends from it. Use ps aux to list processes, top or htop to watch them live, and kill to signal them; all of these are front-ends to kernel services.

4. Managing Rights

Finally, the kernel is the referee of rights management . It knows which UID (User Identifier) and GID (Group Identifier) own each process and each file, and it enforces the permission model (read, write, execute for user, group, and others) plus newer mechanisms such as capabilities and mandatory access control. No user-space program can grant itself a permission the kernel has not allowed.

User Space vs. Kernel Space

The CPU runs in at least two privilege modes. The kernel executes in kernel space (privileged mode), where code has unrestricted access to all hardware and all memory. Every normal program — your shell, browser, or nmap — runs in user space , a restricted mode where it can touch only the memory the kernel has assigned to it and can reach hardware only by asking the kernel.

The controlled crossing point between the two worlds is the system call : a user-space program requests a service (open a file, send a packet, spawn a process) and the CPU switches into kernel mode to perform it, then switches back. Programs almost never invoke system calls raw; they call functions in the standard C library — on Kali, the GNU C Library (glibc) — which wraps each system call in a normal C function. This design is a deliberate safety and stability boundary: a crashed user-space tool cannot take down the kernel, and a misbehaving tool cannot read another user's files without the kernel's consent.

What a Distribution Adds

A kernel alone cannot even show you a login prompt. A Linux distribution packages the kernel together with everything needed to make a usable system:

• Component a distribution adds Kali's choice
• Installer and base system Debian Installer, live images, ARM images
• Package management dpkg plus APT, pulling from the signed kali-rolling repository
• C library and core utilities glibc and GNU coreutils (the same base as Debian)
• Init system systemd (PID 1)
• Default shell and desktop zsh shell, Xfce desktop
• Application set 600+ preinstalled security tools

Distributions differ mainly in these choices — which packages they include, how they configure them, and how they deliver updates — not in the kernel's fundamental behavior. Kali Linux is a Debian-based distribution maintained by OffSec: it follows the Filesystem Hierarchy Standard, tracks Debian Testing as a rolling release, and layers its security toolset and pen-testing-oriented defaults (such as a wireless-injection-patched kernel) on top. When the KLCP exam asks what distinguishes a distribution from Linux itself, the answer is exactly this: Linux is the kernel; the distribution is the curated, packaged, configured whole built around it.