Process Hierarchy (Parent, Child Process)

More Process Rules

  • Every process has a parent process

    • Inherits parent’s attributes

    • E.g. shell starts command ⟶ runs as the same user

  • Except PID 1

    • Started by the kernel during boot

    • First userspace process

    • ⟶ “userspace is born”

    • Ancestor of all processes

    • Usually/historically called init (/sbin/init)

    • Nowadays systemd, on most Linux distributions

  • ⟶ Process tree, starting at PID 1

Typical Process Tree

../../../../../../_images/process-tree.svg
Real world snapshot
$ pstree
systemd-+-ModemManager---3*[{ModemManager}]
        |-NetworkManager---2*[{NetworkManager}]
        |-3*[abrt-dump-journ]
        |-abrtd---2*[{abrtd}]
        |-auditd---{auditd}
        |-avahi-daemon---avahi-daemon
        |-bluetoothd
        |-cupsd
        |-dbus-broker-lau---dbus-broker
        |-dnsmasq---dnsmasq
        |-firewalld---{firewalld}
        |-fwupd---4*[{fwupd}]
        |-polkitd---11*[{polkitd}]
        |-sshd---sshd---sshd---bash
        ...

Services, init

  • PID 1 (init) starts services, usually

    • Background processes ⟶ daemons (i.e. not bound to a terminal)

    • Login daemon on console

    • Secure login daemon on network (Secure Shell Daemon, sshd)

    • Logging

    • Printing

    • …

  • Can be completely different though …

    • “Applicances”

    • Embedded systems are sometimes very dedicated

    • Resource constrained (only a few MB of RAM, tiny flash memory)

    • ⟶ PID 1 is the only process