I know the following are ways processes get started in Linux

  • from init.d (or similar)
  • from shell (by user)
  • forked by a running native daemon

Is it ever possible on Linux for a process to be started, and it does not fall in the above categories? For example, could a process be started without knowledge of the user?

  • 1
    Processes can be started by at, cron, batch commands, which might fall into the fuzzy category "...without knowledge of user..." – MariusMatutiae Jun 28 '15 at 6:16
  • For ar, cron, batch etc. what would they exactly run .. launch a new shell, fork, then execve ? – Jake Jun 28 '15 at 6:18
  • apt-get source cron (and likewise for at) will satisfy your curiosity. Also, not all crons are alike, I am on vixie-cron, do not know about you. In vixie-cron there is a comment (I will spare you the actual code) that says: if there are no debug flags turned on, fork as a daemon should. – MariusMatutiae Jun 28 '15 at 6:41
  • 1
    How, exactly, are you defining "knowledge of the user"? – JdeBP Jun 28 '15 at 10:21

On Linux, almost all processes (including servers and daemon programs) are started with a fork(2) (sometimes implemented in your standard C library using clone(2)) often followed by execve(2) syscall. The daemon(3) library function use these (and some few others) syscalls (listed in syscalls(2)....)

The only exceptions are a few processes magically started by the kernel. These include:

  • init (generally /sbin/init, which could be systemd these days, but you can boot your kernel and pass init=/bin/bash to it thru GRUB) which is started at kernel initialization.

  • some very few programs started magically by the kernel (when some external event occurs), e.g. sometimes modprobe, hotplug, etc....

init existed in 1980 era Unixes (e.g. SunOS3). AFAIK, automagically started hotplug-like processes are a recent Linux addition (probably Linux 3, or at least 2.6, see also udev)

Most programs and processes (including login, bash, getty, cron, atd, mysqld) are all descendants of init with fork & execve You basically can ignore the exceptions (like hotplug), and you could have a Linux system where every process is descendant of init (that was the case with Linux 1.x kernels in the previous century). Use pstree(1) to see the tree of processes.

Read wikipage about Linux startup process & From PowerUp to Bash Prompt (which might be slightly outdated, but most of it is still true).

setuid is a clever mechanism related to privileges (see also setreuid(2), credentials(7), capabilities(7), namespaces(7)).

I recommend reading Advanced Linux Programming at first. Some few features or syscalls appeared after that book (e.g. signalfd(2), inotify(7), epoll(7) ....).

  • so for processes running with my user's privilege on my machine .. they did fork, execve, then setuid ? – Jake Jun 28 '15 at 6:47
  • Yes, ... but setuid executables have their setuid bit set, and it is /sbin/login which is setuid, not most programs. – Basile Starynkevitch Jun 28 '15 at 6:48
  • 1
    No I meant to drop privileges .. – Jake Jun 28 '15 at 6:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.