When I invoke the gnome-control-center from the search bar

searching for "gnome-control" in the Applications menu

The true command which the os runs can be found in ps:

me@alpha:~$ ps -ef | grep gnome-control-center 
me   13952  7293  0 12:20 tty2     00:00:00 gnome-control-center
me   15523  7835  0 12:27 pts/0    00:00:00 grep --color=auto gnome-control-center

It indicates that the operating system opens a terminal tty2, inputs command gnome-control-center, and presses Enter.

When it comes to the init or systemd process

me@alpha:~$ ps -ef | head -5
root         1     0  0 10:34 ?        00:00:05 /sbin/init splash
root         2     0  0 10:34 ?        00:00:00 [kthreadd]
root         3     2  0 10:34 ?        00:00:00 [rcu_gp]
root         4     2  0 10:34 ?        00:00:00 [rcu_par_gp]

With reference to the PID 1, its command is /sbin/init splash.

From where is it input, /sbin/init splash, and press Enter?

The tty is ? which stands for a daemon process.

Is it right if I understand that daemon processes are invoked from a terminal whose name is ? and this terminal is the grandmother of all processes?


Thanks for Sergiy's tutorial about Kernel.

I got the idea intuitively from a picture from a book called "Advanced Programming in the Unix Environment".

The system call fork is to spawn a new process which could be called from shell or from applications.

diagram from book

  • Note that tty2 is already open - that's the TTY that the GUI runs on (in 18.04). For more details see What is a tty, and how do I access a tty? Also the system doesn't press Enter to execute a command, but I'm not sure how it actually works. – wjandrea Jan 16 '19 at 18:15

The ? symbol indicates that there is no tty associated with the process. In other words, there is no real or virtual device where that process can write information. However, the /sbin/init process is in fact "grandmother" of all processes on the system, directly or indirectly. Where does it come from ? The Linux kernel starts it. The kernel can be called "grand-grandmother" of all processes. The steps are described in Linux kernel documentation:


When using initrd, the system typically boots as follows:

  1. the boot loader loads the kernel and the initial RAM disk
  2. the kernel converts initrd into a “normal” RAM disk and frees the memory used by initrd
  3. if the root device is not /dev/ram0, the old (deprecated) change_root procedure is followed. see the “Obsolete root change mechanism” section below.
  4. root device is mounted. if it is /dev/ram0, the initrd image is then mounted as root
  5. /sbin/init is executed (this can be any valid executable, including shell scripts; it is run with uid 0 and can do basically everything init can do).
  6. init mounts the “real” root file system
  7. init places the root file system at the root directory using the pivot_root system call
  8. init execs the /sbin/init on the new root filesystem, performing the usual boot sequence
  9. the initrd file system is removed

Note also that ? indicates it is a daemon. To quote daemon(7) man page:

A daemon is a service process that runs in the background and supervises the system or provides functionality to other processes.

  • Thank you and get the idea of kernel. they are of kernel's system call 'fork' – Alice Jan 16 '19 at 5:53
  • @Alice Yes, exactly. All processes on Linux are result of fork() syscall – Sergiy Kolodyazhnyy Jan 16 '19 at 6:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.