Process Creation

Linux processes form parent-child relationships. A shell commonly starts an external command by creating a child process and arranging for that child to execute the requested program. The classic explanation separates this work into fork and exec operations.

Creating a Child with fork

The fork() system call creates a child process based on the calling process. Parent and child continue from the return point of fork, but receive different return values and have different PIDs.

The child gets logically separate process state. Linux can initially share physical memory pages using copy-on-write, copying a page only when one process modifies it. Open file descriptors are inherited and refer to the same underlying open file descriptions, so details such as file offsets can remain shared.

Replacing a Program with execve

An execve() call loads a new program into the calling process. On success, it replaces the process image and does not return to the old program. The PID remains the same because execve() does not create a new process.

Many shell commands therefore follow a fork-exec pattern:

1. The shell creates a child.
2. The child prepares redirections and other execution state.
3. The child executes the requested program.
4. The shell waits or continues, depending on foreground or background execution.

Libraries and applications can expose higher-level interfaces such as posix_spawn(), and Linux has additional primitives such as clone(). The familiar fork-exec model remains useful without being the only possible interface.

Inspecting Parent and Child IDs

PID identifies the process, while PPID identifies its parent. Request those fields explicitly:

$ ps -o pid,ppid,stat,cmd

If a shell starts ps, the shell's PID will normally appear as the PPID of that ps process. Timing matters: short-lived processes may exit before a separate observation captures them.

PID 1 and Reparenting

The kernel starts the first user-space process with PID 1. Depending on the system, it may be systemd, another init implementation, or a small init inside a container or PID namespace. PID 1 starts and supervises parts of the user-space environment and has special signal and orphan-reaping responsibilities.

When a parent exits before its child, the child is reparented to an appropriate subreaper or the init process in its PID namespace. It does not need to terminate merely because its original parent ended.

The Manage and Monitor Linux Processes lab lets you observe parent and child IDs while running foreground and background commands.

Summary

You can now trace the classic Linux process-creation sequence.

1. Use fork() to create a child with a distinct PID.
2. Use execve() to replace a process image without changing its PID.
3. Read PID and PPID to identify parent-child relationships.
4. Recognize PID 1 and subreapers as destinations for reparented children.