In Linux user inserts command on shell like bash or sh, csh something like that. What happens when user insert command in shell on kernel position?

Does syscall executes when user execute command?

In case that user insert command like vi /etc/passwd. vi /etc/passwd command should be delivered to kernel and kernel will check user permission and if user has permission of /etc/passwd then return file contents or something like that.

  • This might be an interesting read: unix.stackexchange.com/questions/87625/… – Panki May 23 '19 at 7:18
  • By "inserts command on kernel position", do you mean "run a command that requires root privileges"? – Kusalananda May 23 '19 at 7:25
  • @Panki Thanks for replying. It helped a lot to understand my question. Than when user runs vi /etc/passwd than syscall:open excutes to open file? – KHH May 23 '19 at 7:26
  • @Kusalananda I mean when user executes command than what happens. ex. shell deliver user command to a kernel something like that – KHH May 23 '19 at 7:28
  • Your question is too broad. It's like asking "What happens when I turn the ignition key in my car?". The answers would range from "The car starts" to several books on engineering and chemistry. – Kusalananda May 23 '19 at 7:35

This question is very baud as Kusalananda points out. There are a few high level points that might be useful to understand that I couldn't easily fit in comments...

The kernel is not directly responsible for processioning commands in the shell. The shell is a program in it's own right. The shell interprets text input from the user into commands and then performs tasks based on those commands.

It's also important to understand there are several different shells available for Linux including Bash, KSH and ZSH. So the exact syscalls used by a shell may vary a little depending on which shell you're using.

In general, some commands are built directly into the shell but many are actually programs located in directories listed in the PATH environment variable. This means that for many commands, the action taken by the shell is to execute another program. It does this with syscalls fork then exec.


vi /etc/passwd

The shell doesn't know or care what /etc/passwd is. It only knows that vi is a program (/usr/bin/vi). It executes vi using fork(), exec() passing the text "/etc/passwd" as an argument to exec(). It then calls wait to wait for vi to complete and get the return value.

The kernel takes no interest in the "/etc/passwd" string. It is passed to vi and vi then interprets this as a file to open. vi is responsible for calling open to open the file and it's only at this stage the kernel checks if the current user is allowed to open the file.

As stated the exact syscalls used vary a lot and as Kusalananda points out, the question is far too baud to list everything done by the shell but the basic fork() exec() wait() is a common pattern when running any program.

  • Thank you! Your answer is what I was asking for. – KHH May 23 '19 at 11:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.