How to define linux processes and user processes in linux.

  • Your answer is probably wrong. Please read the second answer: ru.stackoverflow.com/a/528603/181472 . If he answers your question, then it makes sense to rearrange the check mark. - Nick Volynkin ♦

1 answer 1

In modern linux, unlike many other Unix, there are so-called "kernel processes". Judging by this, these are just parts of the kernel itself, functions of common kernel code that operate in the same address space and with the same privileges as the rest of the kernel code. Their only difference from other parts of the kernel is that they create separate entries in the process table. They are made by processes so that their execution happens independently from the rest of the kernel, with a lower priority. Their execution takes place under the control of the scheduler, like all other processes in the system.

The linux kernel processes are started by the kernel itself, while the parent process supposedly spawned them, the kthread process is assigned, with PID = 2. Thus, the process of the kernel must be considered the process itself with PID = 2, as well as processes in which the PPID (i.e. the parent's pid) is 2.

sudo ps --ppid=2 --pid=2

User processes - all others:

 sudo ps -N --ppid=2 --pid=2

Also, by default, pstree without parameters shows only the tree of processes generated by init, i.e. user processes. The kernel processes will be sudo pstree 2 .

  • I always thought that init is such a parent superprocess (was, before systemd arrived ) - aryndin
  • one
    @ jumpjet67 init is a normal user process (except that it is the only process started by the kernel itself), it starts all user processes in the system, by ps --ppid=1 you will see all the daemons and terminal handlers running during system initialization, turn start other processes. In many unix systems, there was no such thing as a “kernel process”. In modern linux, they work independently of init and are run by kthread. Found another difference: the processes of the kernel / proc / pid / exe does not indicate anywhere, since there is no executable file on disk - Mike
  • OK. You write "All linux kernel processes are started by one parent kthread process", and in the comment " init - all user processes in the system start". And how are they related to each other? does init start kthread or vice versa? It just turned out a lot of clever words, as a user far from these cases, few of them became clear. - aryndin
  • one
    @ jumpjet67 Having thought it over, I added about pstree in the answer. It shows that linux has two independent process trees, user - generated by init, and nuclear - generated by kthread. Yes, I’ve been a little bit like writing that init is the only process launched by the kernel. This is for other unixes that do not have kernel init processes - the common parent of everything. And in linux, there are nuclear processes, they even work in the address space of the kernel, and the kernel itself starts them as needed, setting it to be the parent of pthread, regardless of init. - Mike