22.214.171.124. Process creation
A new process is created because an existing process makes an
exact copy of itself. This child process has the same environment
as its parent, only the process ID number is different. This
procedure is called forking.
After the forking process, the address space of the child
process is overwritten with the new process data. This is done
through an exec call to the system.
The fork-and-exec mechanism thus switches an old
command with a new, while the environment in which the new program
is executed remains the same, including configuration of input and
output devices, environment variables and priority. This mechanism
is used to create all UNIX processes, so it also applies to the
Linux operating system. Even the first process, init, with process ID 1, is forked during the boot
procedure in the so-called bootstrapping procedure.
This scheme illustrates the fork-and-exec mechanism. The process
ID changes after the fork procedure:
Figure 4-1. Fork-and-exec mechanism
There are a couple of cases in which init
becomes the parent of a process, while the process was not started
by init, as we already saw in the pstree example. Many programs, for instance,
daemonize their child processes, so they can keep on
running when the parent stops or is being stopped. A window manager
is a typical example; it starts an xterm
process that generates a shell that accepts commands. The window
manager then denies any further responsibility and passes the child
process to init. Using this mechanism, it is
possible to change window managers without interrupting running
Every now and then things go wrong, even in good families. In an
exceptional case, a process might finish while the parent does not
wait for the completion of this process. Such an unburied process
is called a zombie process.