This is a rather complex question with regards to what actually happens when you ask the system to run a daemon or program.
Basically, when you ask the system to run a daemon/program, the kernel assigns it a chunk of memory for it to load into. Once loaded, it get executed. Once running, it ask for any additional memory space for heap/stack etc. Depending on the daemon/program, it may then read any CLI options and/or configuration files and set it operating parameters accordingly.
When the daemon/program gets a signal to quit/exit/close, it should first ask/save any data. Within it's shutdown routine, it should release all assigned memory back to the kernel before exiting. The kernel then reclaims the memory space that the program was loaded into and returns it to the free pool.
Of course this is very simplistic and does not even consider the kernel having to move other programs into swap space to make memory available for the newly requested program.
If you would like to know exactly what files are used by any particular daemon/program, check out it's manpages. You mentioned adding a user. If you use the useradd
utility, a look at the end of the manpages for useradd
User account information.
Secure user account information.
Group account information.
Secure group account information.
Default values for account creation.
Directory containing default files.
Shadow password suite configuration.
These are all of the files that useradd
utility would access when you create a new user. Of course, the body of the manpage should explain the conditions that require the use of these files.
For more info, try: