Chapter 12 — Glossary

Definitions match how this manual uses each term; the linked source defines it authoritatively.

• ACL (access control list) — extended permission entries beyond owner/group/other, with a mask that caps effective rights of named entries; inspected with getfacl (getfacl(1)).
• AVC (Access Vector Cache) denial — the SELinux log event recording a policy denial; the starting point for SELinux troubleshooting (RHEL 9: Using SELinux).
• AppArmor — Ubuntu's default MAC system; profiles are enforced or in complain (learning) mode (Ubuntu Server AppArmor).
• Bash-only syntax — arrays, [[ ]], process substitution, brace expansion, pipefail: not POSIX, must be declared via the shebang (Bash Reference Manual).
• Checkpoint (NetworkManager) — a temporary save of network configuration that is automatically restored if not confirmed within a timeout (nmcli).
• Directory execute bit — search/traverse permission, not program execution; required on every parent directory to open a file (GNU Coreutils: File permissions).
• Docker daemon/socket access — effectively host-root privilege, because controlled containers can mount host paths (Docker Engine security).
• fstab → mount units — systemd converts /etc/fstab into mount units at boot and on daemon-reload (systemd.mount(5)).
• **_deleted-but-open file_ — a file unlinked from the namespace but still referenced by a running process; consumes space invisible to du, visible via /proc/PID/fd (proc(5)).
• Inode exhaustion — "filesystem full" caused by metadata/file-count limits rather than bytes; checked with df -i (df(1)).
• LUKS key slot — an independently revocable credential slot in the LUKS header; header damage without backup can permanently deny access (cryptsetup(8)).
• Load average — runnable/uninterruptible task pressure averaged over time, not CPU percent (kernel loadavg).
• LSM (Linux Security Module) — the MAC layer (SELinux, AppArmor); identify the active one before diagnosing denials (RHEL 9: Using SELinux).
• LVM PV/VG/LV — physical volumes aggregated into volume groups sliced into logical volumes; lvreduce risks truncating filesystems that were not shrunk first (LVM2).
• MD RAID — kernel multi-device RAID exposing a virtual block device; provides availability, not backup (mdadm(8)).
• NSS (Name Service Switch) — the configured source chain (/etc/nsswitch.conf) applications actually use for name lookups; distinct from raw DNS (getent(1)).
• NXDOMAIN / SERVFAIL — DNS responses meaning "name does not exist (authoritatively)" vs "resolution failed at the queried resolver" (RFC 1034).
• Partial upgrade (Arch) — refreshing some packages against an otherwise stale system; explicitly unsupported (ArchWiki).
• POSIX.1-2024 (Issue 8) — the portable shell/utilities standard used as this manual's baseline (Open Group).
• RPO / RTO — recovery point objective (acceptable data loss) / recovery time objective (acceptable outage); declared per workload, tested by restore drills (NIST SP 800-61r3).
• Runtime vs permanent (firewalld) — two distinct configurations; reload replaces runtime with permanent and discards runtime-only changes (firewall-cmd).
• SNI / SAN / DNS-ID — TLS hostname indication, certificate Subject Alternative Name, and the identifier type used for service-identity matching (RFC 9525).
• Stub resolver — a local forwarding resolver (e.g., systemd-resolved's on 127.0.0.53 semantics as linked via /etc/resolv.conf); the symlink target is not the upstream (systemd-resolved).
• Transaction (package manager) — the resolved set of installs/upgrade/removals proposed for confirmation; always review it, especially removals (DNF5 upgrade).
• set -e / pipefail — shell error handling whose semantics have exceptions and Bash-specificity; use intentional status checks (Bash Reference Manual: Pipelines).
• setgid on a directory — new entries inherit the directory group; a shared-directory pattern with mode 2770 (GNU Coreutils: setgid).
• UID/--preserve-root — GNU tools' guard against recursive operations on / (GNU Coreutils: Treating / specially).
• x-systemd.* — systemd-specific fstab options controlling mount dependencies/behavior; not portable across init systems (systemd.mount(5)).