Understanding Linux processes: PIDs, parents, and process trees

// The basics of processes in Linux

Every application you run on a Linux system is a process. Each process is assigned a unique identifier known as a Process ID (PID). This PID is essential for managing the process, and it plays a critical role in the way processes interact with each other. Understanding the parent-child relationship among processes helps defenders track system behavior and potential threats.

// PIDs and Process Creation

When a new process is created, it inherits a PID. The first process started by the kernel during boot is usually PID 1, known as init or systemd, depending on the distribution. Each subsequent process gets the next available PID.

To list all the processes currently running on your Linux system along with their PIDs, use the command:

ps aux

This command outputs several columns:

• USER: Owner of the process
• PID: Process ID
• %CPU: CPU usage
• %MEM: Memory usage
• COMMAND: The command that initiated the process

For example, running ps aux might yield:

USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.0  0.2  60188  3488 ?        Ss   10:03   0:01 /sbin/init
youruser     123  0.0  0.1  45564  2432 pts/0    S+   10:05   0:00 bash

In this output, the init process has a PID of 1, and a user youruser is running a bash shell with a PID of 123.

// Parent-Child Relationship

Processes can spawn new processes. The process that creates another process is referred to as the parent, while the newly created process is the child. Each child process inherits some properties from its parent, including the parent’s PID, which allows for tracking and managing the entire process tree.

You can visualize the parent-child relationship using:

pstree

This command displays the process tree in a hierarchical format. An example output might look like:

init─┬─bash─┬─ssh
     │      └─vim
     └─systemd─┬─systemd-journal
                └─systemd-logind

In this example, init is the root of the process tree, with bash as a child process, and ssh and vim as its descendants.

// Defensive Implications

Understanding process trees is critical for defending against malicious activity. Here are a few scenarios:

• Anomalous Processes: If you see a process that shouldn’t be running or has an unusual parent, it could indicate compromise.
• Resource Utilization: Monitoring CPU and memory usage of processes can reveal unexpected behaviors, such as cryptojacking.
• Process Lifecycles: Processes that spawn too many child processes in quick succession might be indicative of a fork bomb or other exploitation techniques.

// Checklist for Monitoring Processes

1. Regularly check the output of ps aux. 2. Use pstree to visualize process hierarchies. 3. Look for processes that have unusual names or origins. 4. Monitor resource usage (CPU and memory) for spikes. 5. Investigate processes with a parent PID of 1 that were started recently.

// Common Mistakes to Avoid

• Ignoring PID Reuse: If a process exits, its PID can be reused, which may lead to confusion during investigations.
• Neglecting Permissions: Not all users can see all processes. Ensure you have appropriate permissions to capture complete information.
• Overlooking Zombie Processes: These are remnants of processes that have finished execution but still have an entry in the process table, often needing a parent to read their exit status. Use ps aux | grep Z to find them.

// Conclusion

Understanding processes, their PIDs, and the structure of process trees is fundamental for effective system management and threat detection. By monitoring and analyzing these relationships, defenders can identify and respond to anomalies more efficiently. Familiarity with these concepts can significantly improve your security posture in Linux environments.

The DaemonCore Academy curriculum is free and provides further insights into these topics. Be sure to practice in a controlled, disposable environment you own.