Overview
Processes on Linux form a tree: every process (except the first) is started by another, creating parent/child relationships. This lineage explains how programs launch one another and is a valuable investigative trail. This lesson covers the process hierarchy.
Learning objectives
- Explain parent and child processes.
- Describe how processes are created (fork/exec concept).
- Interpret a process tree and recognize orphans/zombies.
Core concept
Each process has a parent (identified by its PPID) that created it, and may have children it creates in turn. This forms a process tree rooted at PID 1. New processes are created when a parent forks (creates a copy of itself) and typically then execs (replaces that copy with a new program). Two special states arise:
- Orphan — a process whose parent exited; it is "adopted" by PID 1.
- Zombie — a process that has finished but whose exit status the parent has not yet collected; it lingers in the table until reaped.
How it works
When you launch a command from a shell, the shell is the parent and the command is its child. That child may spawn its own children (e.g. a script running other programs), extending the tree. If a parent dies before its child, the child becomes an orphan and PID 1 adopts it (so it still has a parent). A finished child becomes a zombie only until the parent reads its exit status; well-behaved parents reap children promptly, keeping zombies transient.
Practical example
$ ps -ef --forest | grep -A2 sshd
root 900 1 ... /usr/sbin/sshd
root 1520 900 ... \_ sshd: alice [priv]
alice 1540 1520 ... \_ -bash
The tree shows sshd (parent PID 900, itself a child of PID 1) spawning a session process, which spawns Alice's bash shell. Reading the indentation reveals exactly how Alice's shell came to exist — launched via SSH.
Cybersecurity relevance
Process lineage is a powerful investigative tool. Examining the parent of a suspicious process can reveal how it was launched — for example, a shell spawned by a web server process (www-data) is a classic sign of a web exploit yielding command execution. Tracing the tree helps reconstruct an attack chain and identify persistence. Unusual parent/child relationships (a document viewer spawning a shell, say) are common detection signals in blue-team work.
Common mistakes
- Ignoring the parent of a process, missing how it was launched.
- Confusing orphans and zombies — orphans are re-parented to PID 1 and keep running; zombies are finished but not yet reaped.
- Overlooking suspicious lineage (e.g. a service process spawning an interactive shell).
Key takeaways
- Processes form a tree rooted at PID 1; each has a parent (PPID) and may have children, created via fork/exec.
- Orphans (parent exited) are adopted by PID 1; zombies (finished but not reaped) linger until the parent collects their status.
- Process lineage reveals how a process was launched, making it a key trail for reconstructing attacks and spotting suspicious parent/child relationships.
Check your understanding
- What is the difference between an orphan process and a zombie process?
- Why is examining a suspicious process's parent useful during an investigation?