Question

I know I can use the trick if (fork()) exit(0); to change the pid of the current process. So, the following program would have a pid changing very quickly. How to kill a process like this? Is there some better method than executing a lot of killall procname until one get able to run kill() before it forks? I know it is not a ‘process’, but many processes that run for a few microseconds each.

#include <unistd.h>
#include <stdlib.h>
#include <stdio.h>

int main()
{
    pid_t self = getpid();
    while (1)
    {
        if (fork()) exit(0);
        if (self + 10000 < getpid()) break; // Just to kill it after some time
        usleep(1000);
    }
    return 0;
}

Also the only way I found to list the process was executing ps -A | grep procname a few times until one showed some output. Why isn’t the process always listed?

Answer 1

Such a process is called a “comet” by systems administrators.

The process group ID (PGID) doesn’t change on fork, so you can kill it (or SIGSTOP it) by sending a signal to the process group (you pass a negated PGID instead of a PID to kill).