Also known as: UEFI Secure Boot · verified boot
Secure Boot is a UEFI firmware feature that verifies the cryptographic signature of each component in the boot chain — bootloader, kernel, and drivers — refusing to execute anything not signed by a trusted key.
Its purpose is defending against bootkits, malware that loads before the operating system and can therefore subvert every security control the OS would otherwise apply.
On Linux the mechanism typically relies on a small signed shim, allowing distributions to chain to their own signing keys. Users retain the ability to enrol their own keys or disable the feature, which is what distinguishes it from a locked platform.
Kernel
The kernel is the core of an operating system, responsible for managing memory, scheduling processes, and mediating all access between software and hardware. The Linux kernel is the component that makes a system 'Linux'.
Kernel Module
A kernel module is a piece of code that can be loaded into and unloaded from a running Linux kernel on demand, extending its functionality — most commonly with device drivers — without requiring a reboot or recompilation.
Code Signing
Code signing is the practice of cryptographically signing software artifacts so that recipients can verify who produced them and confirm the code has not been altered since signing.
Linux Distribution
A Linux distribution is a complete operating system built around the Linux kernel, bundling it with system libraries, a package manager, default utilities, and a curated set of software, along with policies for how all of it is maintained and updated.