Linux Processes & Signals

A signal is an async notification the kernel delivers to a process. SIGTERM asks it to exit and can be caught for cleanup; SIGKILL force-terminates it and cannot be caught, blocked, or ignored; SIGHUP means a terminal hangup and by convention tells daemons to reload config; SIGSTOP pauses a process (also uncatchable) and SIGCONT resumes it.

A process is a running instance of a program with its own PID, a parent PID (PPID), a private virtual address space, and a table of open file descriptors. fork clones the caller into a near-identical child using copy-on-write pages; exec then replaces that child's memory image with a new program while keeping the same PID.

A file descriptor is a small non-negative integer a process uses to refer to an open file, socket, or pipe — an index into its per-process table of open handles. By convention fd 0 is standard input, fd 1 is standard output, and fd 2 is standard error. Redirection and pipes just rewire these numbers, which is why 2>&1 sends stderr to wherever stdout points.

R is running or runnable (on a CPU or waiting for one). S is interruptible sleep — waiting for an event and wakeable by a signal. D is uninterruptible sleep, usually blocked in a kernel I/O call and not even killable until it returns. T is stopped by a signal like SIGSTOP. Z is a zombie — exited but not yet reaped by its parent.

A zombie is a process that has exited but whose parent has not yet wait()ed on it, so the kernel keeps a tiny entry holding just its PID and exit status. It is already dead — you cannot kill -9 a zombie. It clears when the parent reaps it (often after a SIGCHLD); if the parent never does, killing or ending the parent reparents nothing but lets init reap it.

An orphan is a still-alive process whose parent has exited. The kernel reparents it to init (PID 1), which becomes its new parent and later wait()s on it when it exits, so an orphan does not become a zombie. That is why PID 1 must reap children — a naive container init that ignores SIGCHLD leaks zombies from its adopted orphans.

D is uninterruptible sleep: the process is blocked inside a kernel call — here dd waiting on failing disk I/O. SIGKILL is queued but cannot be delivered until that syscall returns, so kill -9 does nothing while it hangs. You cannot force it dead; fix the underlying I/O (the sick device, an NFS mount, storage) so the call unblocks and it exits — otherwise reboot the host.

PATH is an environment variable holding a colon-separated list of directories. For a bare command like ls, the shell searches those directories left to right and runs the first matching executable, so order matters. A command with a slash (./app, /usr/bin/ls) skips the search entirely. which shows which one would win.

A syscall is the controlled entry point through which a user-mode program asks the kernel to do something privileged — read a file, open a socket, fork. The program can't touch hardware directly, so it triggers a trap (a special instruction like syscall) that switches the CPU to kernel mode, runs the handler, and returns the result to user mode.