This lesson explores the fundamental concepts of how new processes are started on a Linux system. Understanding this mechanism provides insight into the inner workings of the operating system.
The Fork and Exec Model
The primary mechanism for process creation in Linux involves an existing process cloning itself using the fork system call. The fork call creates a nearly identical child process. This new child process receives its own unique Process ID (PID), while the original process becomes its parent, identified by a Parent Process ID (PPID).
After forking, the child process can either continue running the same program as its parent or, more commonly, use the execve system call to load and run a new program. The execve call effectively replaces the process's memory space with that of the new program, allowing a different task to begin. This two-step "fork-exec" model is a cornerstone of how you create a process in Linux.
Observing Parent-Child Relationships
We can observe this parent-child relationship in action using the ps command:
ps lThe l option provides a "long format" view, showing more detail about running processes. You will see a column labeled PPID, which stands for Parent Process ID. Look at the process for your current shell (e.g., bash). When you run the ps l command, you'll notice that the PID of your shell process matches the PPID of the ps l process. This is because your shell forked itself to create the ps process.
The Init Process
If every process is a child of another, there must be an original ancestor. This is the init process. When the system boots, the kernel creates init as the very first user-space process, assigning it a PID of 1. The init process is the ultimate parent of all other processes and runs with root privileges to manage the system. It cannot be terminated until the system shuts down and is responsible for spawning many of the services that keep the system running.