Hi!

I remember that I saw somewhere a parameter to define the minimum PID value for user processes, which means any PID that is below that is a kernel process.

The thing is, I don't remember where... was it in my kernel config?
How to read and define this value?

THANKS!

I'm afraid I have never heard about reserved PIDs. see here: http://en.wikipedia.org/wiki/Process_identifier. Can you please explain what do you mean?

If you look at
you'll realize all the first (small) PIDS are kernel processes.
You can e.g. guess that if PID < 300, this is a kernel process, so you'd better not try to kill it!

The thing is, this is not always 300 and this number can be configured (and read). I just don't remember where.

I see. There is no limit, there is no such number, it always depend on the actual configuration. There is no general rule.

As to unique identifiers in kernels up to 2.6.18 (RHEL version w backports), what these processes have in common is all kernel threads share the same user Id (obviously 0) and the same session Id and process group Id. What's more is that, depending on the machines HW, "kthread" spawns a host of children which then share the common "kthread" ancestors identifiers.


There is a "RESERVED_PIDS" with default value of 300 in kernel/pid.c (2.6.29 - 3.4: http://lxr.free-electrons.com/source...pid.c?v=2.6.29) but if you would run a '\ps axfo pid,ppid,pgid,sid,sess,uid,cmd --sort=pid' then you see no artificial limit is posed.


I'll move this thread out of the Linux Security forum to the Kernel forum as this in no way is related to Linux Security.
Next time please give a wee bit more thought to where you post, TIA.

Ah ok!
fine

Sorry, I've never seen there was kernel section!

No need to be sorry, just have fun.

1 members found this post helpful.

PID #1 (init) is hard-coded. This process-table entry is constructed "by hand" during kernel initialization, and this very special process cannot die. (If it does, the kernel panics.)

Some operating systems have several such "hand built" entries, and the definition and purpose of these special processes vary from system to system.

"Kernel threads" are parts of the operating system kernel that are need to operate in an asynchronous fashion. (For instance, kswapd needs to perform disk I/O and to wait for completion of those I/O operations.) They are nevertheless "fully part of the kernel" and as such they operate by special rules. They will typically have low-numbered PIDs although there are no fixed assignments.