Measured boot
Each boot stage hashes the next into TPM PCRs before running it, producing a record of exactly what booted.
In measured boot firmware measures the bootloader, the bootloader measures the kernel and its configuration, and so on, extending each hash into a PCR and appending an entry to the event log. Nothing is blocked; the result is evidence.
That evidence is used two ways: locally, by sealing secrets (disk keys) so they only unseal on a known-good chain, and remotely, by quoting PCRs to a verifier during attestation. Windows calls the remote use Measured Boot with health attestation; Linux uses IMA for runtime file measurements beyond boot.
Common confusion with Secure Boot: Secure Boot enforces (refuses to run unsigned code), measured boot records (runs anything but tells the truth about it). You want both, because a signed but vulnerable bootloader passes Secure Boot yet shows up in measurements.