4.1 What Linux Is and What It Does

The Kernel and Its Four Core Responsibilities

Strictly speaking, Linux is only the kernel — the core program of the operating system, loaded into memory by the bootloader when the machine starts and running until shutdown. Everything else you interact with, from the zsh prompt to the Xfce desktop, is ordinary software that the kernel hosts. The exam expects you to separate these two ideas: the kernel itself, and the distribution built around it. The kernel's job breaks down into four responsibilities.

1. Driving the Hardware

The kernel is, first of all, a collection of hardware drivers. It detects and controls the machine's components — CPU, memory, disks, network cards, USB devices, displays — and presents them to the rest of the system through uniform interfaces. Driver code can be compiled directly into the kernel image or loaded on demand as kernel modules (.ko files, managed with tools such as lsmod, modprobe, insmod, and rmmod). This modularity is why Kali can ship a kernel patched for wireless injection while still supporting a huge range of chipsets: the injection-capable drivers are simply modules you load when you need them.

2. A Unified Filesystem Abstraction

Unix systems are famous for the idea that everything is a file, and the kernel enforces it. Whether data lives on an ext4 partition, a FAT32 USB stick, an NFS share, or a CD-ROM, the kernel's virtual filesystem layer presents all of it through one directory tree with one set of operations (open, read, write, close). The clearest expression of this is /dev, the directory of device files that represent hardware as files:

• Block devices (type b in an ls -l listing) are accessed in fixed-size blocks with random access — hard disks and SSDs such as /dev/sda or /dev/nvme0n1.
• Character devices (type c) are read or written as sequential streams of bytes — keyboards, mice, terminals, and serial ports such as /dev/ttyS0.

Special files like /dev/null (discards anything written), /dev/zero (an endless stream of zero bytes), and /dev/random / /dev/urandom (random data from the kernel's entropy pool) are pseudo-devices provided directly by the kernel. On modern Kali, /dev is populated dynamically by udev, so entries appear and disappear as hardware is plugged in or removed.

3. Managing Processes

The kernel creates, schedules, and destroys processes. It divides CPU time among everything that is running (preemptive multitasking), allocates memory to each process, and enforces isolation so one process cannot read another's memory. The very first user-space process — on Kali, systemd — receives PID (Process Identifier) 1, and every other process descends from it. Use ps aux to list processes, top or htop to watch them live, and kill to signal them; all of these are front-ends to kernel services.

4. Managing Rights

Finally, the kernel is the referee of rights management. It knows which UID (User Identifier) and GID (Group Identifier) own each process and each file, and it enforces the permission model (read, write, execute for user, group, and others) plus newer mechanisms such as capabilities and mandatory access control. No user-space program can grant itself a permission the kernel has not allowed.

User Space vs. Kernel Space

The CPU runs in at least two privilege modes. The kernel executes in kernel space (privileged mode), where code has unrestricted access to all hardware and all memory. Every normal program — your shell, browser, or nmap — runs in user space, a restricted mode where it can touch only the memory the kernel has assigned to it and can reach hardware only by asking the kernel.

The controlled crossing point between the two worlds is the system call: a user-space program requests a service (open a file, send a packet, spawn a process) and the CPU switches into kernel mode to perform it, then switches back. Programs almost never invoke system calls raw; they call functions in the standard C library — on Kali, the GNU C Library (glibc) — which wraps each system call in a normal C function. This design is a deliberate safety and stability boundary: a crashed user-space tool cannot take down the kernel, and a misbehaving tool cannot read another user's files without the kernel's consent.

What a Distribution Adds

A kernel alone cannot even show you a login prompt. A Linux distribution packages the kernel together with everything needed to make a usable system:

Distributions differ mainly in these choices — which packages they include, how they configure them, and how they deliver updates — not in the kernel's fundamental behavior. Kali Linux is a Debian-based distribution maintained by OffSec: it follows the Filesystem Hierarchy Standard, tracks Debian Testing as a rolling release, and layers its security toolset and pen-testing-oriented defaults (such as a wireless-injection-patched kernel) on top. When the KLCP exam asks what distinguishes a distribution from Linux itself, the answer is exactly this: Linux is the kernel; the distribution is the curated, packaged, configured whole built around it.