In this lesson, you will learn how a Linux process transforms from a duplicate of its parent into an entirely new program using the "fork-exec" handshake.
The Great Divide: Fork
When you type a command into your shell, the shell doesn't just "run" it directly. First, it calls the fork() system call. Think of fork() as a biological cell division: the shell creates an exact clone of itself.
At this precise moment, you have two identical processes: the original (the parent) and the new clone (the child). They share the same memory, the same open files, and are executing the same code. The only difference is their "return value"—the child receives a 0, while the parent receives the child’s unique ID (the PID).
The Transformation: Exec
The child process is currently just a copy of the shell, which isn't useful if you want to run something like ls or grep. This is where execve (or its variants) comes in.
When the child calls execve, the operating system takes the program binary stored on your disk (like /bin/ls), loads it into the child's memory, and wipes away the previous code (the shell clone). The child process is effectively "reborn" as the new program.
It looks like this in practice:
pid_t pid = fork();
if (pid == 0) {
// We are the child!
// Replace this process memory with 'ls'
execve("/bin/ls", args, env);
} else {
// We are the parent shell!
// Wait for the child to finish.
wait(NULL);
}
Why two steps?
You might wonder why we don't just create a new process with a command in one go. By splitting the work, the shell gains a "window" of time after the fork() but before the execve(). During this tiny window, the child can perform setup tasks—like redirecting input/output (e.g., sending the output of a command to a file instead of your screen)—without affecting the parent shell. Once the environment is perfectly configured, the execve call triggers the final switch.
Key Takeaway: The shell clones itself using fork() to create a workspace, then uses execve() to replace that workspace with the target program.