Parent process

In Unix-like operating systems, every process except process 0 (the swapper) is created when another process executes the fork() system call. The process that invoked fork is the parent process and the newly created process is the child process. Every process (except process 0) has one parent process, but can have many child processes.

The operating system kernel identifies each process by its process identifier. Process 0 is a special process that is created when the system boots; after forking a child process (process 1), process 0 becomes the swapper process (sometimes also known as the "idle task"). Process 1, known as init, is the ancestor of every other process in the system.[1]

The operating system maintains a table that associates every process, by means of its process identifier (generally referred to as "pid") to the data necessary for its functioning. During a process's lifetime, such data might include memory segments designated to the process, the arguments it's been invoked with, environment variables, counters about resource usage, user-id, group-id and group set, and maybe other types of information.

When a process terminates its execution, either by calling exit (even if implicitly, by executing a return command from the main function) or by receiving a signal that causes it to terminate abruptly, the operating system releases most of the resources and information related to that process, but still keeps the data about resource utilization and the termination status code, because a parent process might be interested in knowing if that child executed successfully (by using standard functions to decode the termination status code) and the amount of system resources it consumed during its execution.

By default, the system assumes that the parent process is indeed interested in such information at the time of the child's termination, and thus sends the parent the signal SIGCHLD to alert that there is some data about a child to be collected. Such collection is done by calling a function of the wait family (either wait itself or one of its relatives, such as waitpid, waitid or wait4). As soon as this collection is made, the system releases those last bits of information about the child process and removes its pid from the process table. However, if the parent process lingers in collecting the child's data (or fails to do it at all), the system has no option but keep the child's pid and termination data in the process table indefinitely.

Such a terminated process whose data has not been collected is called a zombie process, or simply a zombie, in the UNIX parlance. The name is a humorous analogy due to considering terminated process as "no longer alive" or "dead"—since it has really ceased functioning—and a lingering dead process still "incarnated" in the "world of the living" processes—the process table—which is therefore actually "undead", or "zombie".

Zombie processes might pose problems on systems with limited resources or that have limited-size process tables, as the creation of new, active processes might be prevented by the lack of resources still used by long lasting zombies.

It is, therefore, a good programming practice in any program that might spawn child processes to have code to prevent the formation of long lasting zombies from its original children. The most obvious approach is to have code that calls wait or one of its relatives somewhere after having created a new process. If the program is expected to create many child processes that may execute asynchronously and terminate in an unpredictable order, it is generally good to create a handler for the SIGCHLD signal, calling one of the wait-family function in a loop, until no uncollected child data remains. It is possible for the parent process to completely ignore the termination of its children and still not create zombies, but this requires the explicit definition of a handler for SIGCHLD through a call to sigaction with the special option flag SA_NOCLDWAIT.[3]

Orphan processes are an opposite situation to zombie processes, referring to the case in which a parent process terminates before its child processes, which are said to become "orphaned". Unlike the asynchronous child-to-parent notification that happens when a child process terminates (via the SIGCHLD signal), child processes are not notified immediately when their parent finishes. Instead, the system simply redefines the "parent PID" field in the child process's data to be the process that is the "ancestor" of every other process in the system, whose PID generally has the value of 1 (one), and whose name is traditionally "init" (except in the Linux kernel 3.4 and above [more info below]). Thus, it was said that init "adopts" every orphan process on the system.[4][5]

A somewhat common assumption by programmers new to UNIX was that the child processes of a terminating process will be adopted by this process's immediate parent process (hence those child processes' "grandparent"). Such assumption was incorrect – unless, of course, that "grandparent" was the init itself.

After Linux kernel 3.4 this is no longer true, in fact processes can issue the prctl() system call with the PR_SET_CHILD_SUBREAPER option, and as a result they, not process #1, will become the parent of any of their orphaned descendant processes. This is the way of working of modern service managers and daemon supervision utilities including systemd, upstart, and the nosh service manager.

This is an abstract of the manual page, reporting that:

A subreaper fulfills the role of init(1) for its descendant processes. When a process becomes orphaned (i.e., its immediate parent terminates) then that process will be reparented to the nearest still living ancestor subreaper. Subsequently, calls to getppid() in the orphaned process will now return the PID of the subreaper process, and when the orphan terminates, it is the subreaper process that will receive a SIGCHLD signal and will be able to wait(2) on the process to discover its termination status.[6]