How are new processes created on Unix and Linux, and which process is at the top?
At boot the kernel starts the init process (PID 1, today systemd); every other process is copied from an existing one with the fork() system call.
* Every process descends from PID 1; children inherit the user unless something changes it. *
Processes form a tree. The kernel starts init as PID 1, and init starts the system services. Each of them can start child processes in turn:
fork()makes a copy of the calling process. The child gets a new PID and inherits the parent's user, environment and open files.- The child usually calls
exec()to replace that copy with a different program.
Because the user is inherited, a child runs with the same rights as its parent unless something changes them on purpose. Examples are a service manager starting a program as a service account, or a SUID bit on the program.
ps -ef shows the tree's details: UID, PID and the PPID (the parent's PID) for each process. pstree draws it.
Go deeper:
Wikipedia: fork (system call) — fork, exec and copy-on-write.- UIC course notes: Processes — process creation and the process tree, with diagrams.