News for hackers. Stuff that matters.
Re:The Linux kernel can spawn processes on its own by josephcsible on Saturday June 11, 2022 @02:10PM (#31706671)
I wonder what the parent PID of these processes is.
Re:The Linux kernel can spawn processes on its own by sounds on Saturday June 11, 2022 @07:33PM (#31709526)
That's what the "kthreadd" kernel process is for.

Try this command:

  ps axo pid,ppid,comm | less
The kernel-created processes will all have "kthreadd" as their Parent Process ID (PPID). Typically init and kthreadd are the only processes with a PPID of 0.
Re:The Linux kernel can spawn processes on its own by CameronNemo on Saturday June 11, 2022 @07:57PM (#31709717)
Yep, and aiui kthreadd on Linux always has a PID of 2. If you are ever trying to filter out kernel processes from ps output (and usermode helpers, apparently), you can check if the pid is 2 or ppid is 2.
Re:The Linux kernel can spawn processes on its own by cmeacham98 on Saturday June 11, 2022 @02:14PM (#31706704)
init has a ppid of 0, which effectively is a special value that means the kernel. These processes probably also do the same thing (and thus, ppid=0 is a good way to detect kernel-started processes).
Re:The Linux kernel can spawn processes on its own by eMPee584 on Sunday June 12, 2022 @04:25PM (#31717956)
The other kernel workers get spawned by `kthreadd`, which has PPID = 0, PID = 2 under systemd.
Re:The Linux kernel can spawn processes on its own by jstimpfle on Saturday June 11, 2022 @02:40PM (#31706963)
I think they could be spawned with ppid 1 as well.