There is a difference between a program and a process. A program is a static entity—the machine instructions that are to be executed. A process is a dynamic entity. A process includes not only the instructions of the program, but also its data and stack, its open files, its file locks, its semaphores, etc. Thus a process is what a program becomes once it is in the machine and executing. A process is not just a program. It is also all the resources allocated to the running program by the operating system.

The naive user believes that they start processes. In fact, only processes start other processes. When the user types a command such as

$ emacs afile.txt

the user's shell spawns emacs. We say that emacs is a child process of the user's shell. Emacs may spawn children of its own. These processes become the grandchildren of the user's shell.

Normally the shell waits for the child to terminate before it continues. However, since Unix is multi-tasking, it is possible for a process to continue right away after spawning a child. In this way a parent process can spawn other children before the first child has died. In turn the children can spawn multiple children of their own. Thus a user's shell might be the root of a tree of processes. Since many programs spawn processes to perform their functions, a user might not even be aware of all the processes that are executing on his/her behalf.

What of the user's shell? In fact, it is a child of a special process called init. The init process is the first process that runs on a Unix machine. It is started by the kernel when the system is booted. It is the only process ever started by the kernel. Init reads certain files to configure itself and then it spawns a shell to execute some scripts that are typically stored in the /etc directory. These scripts perform the bulk of the system startup activities.

Once the startup scripts have been processed, init spawns a getty process for every serial terminal on the system. Information about all these terminals is stored in a text file. The getty process displays "login:" on the terminal and waits for a user to come along.

When a user responds to the login prompt, getty overlays itself with the login program. The login program (officially still a child of init) then prompts for the password and verifies that it is correct. The login program then overlays itself with the shell program specified in the user's /etc/passwd entry.

The startup scripts typically also start inetd, the Internet daemon program. This program listens to the network waiting for various types of requests. If a remote user runs a telnet program, inetd picks up the request and spawns telnetd to handle it. The program telnetd then constructs a virtual terminal session, accepts the user's login, and attachs the appropriate shell to the virtual terminal. The inetd process is also responsible for spawning ftpd, fingerd, and other daemon programs as necessary depending on the type of requests that arrive from the network.

When the user exits their shell, init is awakened (it sleeps once all the getty processes have been started). Seeing that one of its children has died, init spawns a new getty and goes back to sleep.