Linux processes form parent-child relationships. A shell commonly starts an external command by creating a child process and arranging for that child to execute the requested program. The classic explanation separates this work into fork and exec operations.
Processes · Lesson 4
Process Creation
Learn how fork, exec, PIDs, and parent relationships participate in Linux process creation.
Creating a Child with `fork`
The fork() system call creates a child process based on the calling process. Parent and child continue from the return point of fork, but receive different return values and have different PIDs.
The child gets logically separate process state. Linux can initially share physical memory pages using copy-on-write, copying a page only when one process modifies it. Open file descriptors are inherited and refer to the same underlying open file descriptions, so details such as file offsets can remain shared.
What does a successful fork() create?
Replacing a Program with `execve`
An execve() call loads a new program into the calling process. On success, it replaces the process image and does not return to the old program. The PID remains the same because execve() does not create a new process.
Many shell commands therefore follow a fork-exec pattern:
- The shell creates a child.
- The child prepares redirections and other execution state.
- The child executes the requested program.
- The shell waits or continues, depending on foreground or background execution.
Libraries and applications can expose higher-level interfaces such as posix_spawn(), and Linux has additional primitives such as clone(). The familiar fork-exec model remains useful without being the only possible interface.
What happens to a process's PID after a successful execve()?
Inspecting Parent and Child IDs
PID identifies the process, while PPID identifies its parent. Request those fields explicitly:
$ ps -o pid,ppid,stat,cmd
If a shell starts ps, the shell's PID will normally appear as the PPID of that ps process. Timing matters: short-lived processes may exit before a separate observation captures them.
What does PPID represent in a process listing?
PID 1 and Reparenting
The kernel starts the first user-space process with PID 1. Depending on the system, it may be systemd, another init implementation, or a small init inside a container or PID namespace. PID 1 starts and supervises parts of the user-space environment and has special signal and orphan-reaping responsibilities.
When a parent exits before its child, the child is reparented to an appropriate subreaper or the init process in its PID namespace. It does not need to terminate merely because its original parent ended.
Which statement about PID 1 is accurate?
The Manage and Monitor Linux Processes lab lets you observe parent and child IDs while running foreground and background commands.
Lesson complete
You finished Process Creation
You can now trace the classic Linux process-creation sequence.
Use
fork()to create a child with a distinct PID.Use
execve()to replace a process image without changing its PID.Read PID and PPID to identify parent-child relationships.
Recognize PID 1 and subreapers as destinations for reparented children.
Keep your learning progress
Create a free account to save this lesson and continue learning on any device.
Create a free account