These slides were prepared by Jonathan Kamens for a SIPB Microcourse entitled “What runs on your workstation,” first given on January 24, 1992, from 12 noon to 2 PM in Twenty Chimneys in the Student Center.

What runs on your workstation?

Jonathan Kamens

MIT Student Information Processing Board (SIPB (ΣΠB))

January 24, 1992 Why should you want to know?

• Verifying workstation security.

• Learning more about UNIXTM .

• Learning more about Athena.

• Customizing your environment.

Some definitions:

process One particular task running on the workstation. Most processes correspond to executable files residing on disk somewhere, but there are a few “special” processes that are created by the kernel and do not have associated executables.

kernel The program that controls the workstation, handling such underlying tasks as file access for running processes.

root (from The New Hacker’s Dictionary) “The superuser account that ignores permission bits, user number 0 on a UNIX system. This account has the user name ’root’. The term avatar is also used.” Most background processes running on the workstation are owned by root.

daemon (ibid) “[from the mythological meaning, later rationalized as the acronym ’Disk And Execution MONitor’] A program that is not invoked explicitly, but lies dormant waiting for some condition(s) to occur.” Also, the username of an unprivileged user that owns some daemon processes.

How do daemons get started?

Two different ways:

1. Started during the workstation reboot procedure. Processes started in this way are usually intended to stay alive as long as the workstation is running, although some of them can be killed and restarted safely.

2. Started by daemons of the above type.

In fact, all processes fall in one of the two categories above.

What exactly happens when a workstation reboots?

VAX, RT (BSD 4.3) or DECstation (Ultrix^{TM} 4.2):

1. Small boot program loads kernel into memory and hands control over to it.

2. Kernel initializes itself, and then invokes /etc/init with appropriate arguments.

3. Init runs /etc/rc, which starts up pretty much everything, and then starts up processes listed in its configuration file, /etc/ttys.

RS/6000 (AIX 3.1):

1. Kernel, boot filesystem and previous device configuration are loaded into a RAM disk.

2. Basic configuration is done in order to be able to access disk volumes; paging device is located and root filesystem disk is checked.

3. Root filesystem is mounted and control passes to it.

4. Shells scripts that are executed are rc.boot3, rc.boot4,

brc and rc.

5. Init is quite different – it’s System V-like, rather than BSD-like. For example, it uses /etc/inittab instead of tt /etc/ttys. See the man page for more information.

See Section 6 in the file /usr/lpp/bos/bsdadm

on an RS/6000 for details about the RS/6000 boot procedure, which is rather complex.

How do you find out what processes are running?

Use the ps command. For example, ps aux for a complete listing. See the man page for more information. afsd

Stands for: AFS daemon

Path: /etc/athena/afsd

Platforms: all Started by: rc.athena on RS/6000, rc otherwise Purpose: Handles client access to AFS, e.g. cache

management, getting files from AFS servers, writing files to AFS servers

Life cycle: Started at boot time, cannot be killed. Documentation: none on-line Source code: restricted Notes: (1) On the VAX and RT, afsd processes have

no name in ps listings. On the DECstation, they are identified simply as afsd. On the RS/6000, the full command line is given. (2) There should be six afsd processes running on a normal workstation. There are multiple processes so that multiple AFS requests can be handled simultaneously. (3) After starting up, the afsd processes call a system call that hangs forever.

biod

Stands for: block input/output daemon

Path: /usr/etc/biod on the RS/6000, /etc/biod oth-

erwise Platforms: all Started by: rc.nfs on RS/6000, rc otherwise Purpose: Handles NFS client requests. Life cycle: One or more can be killed and restarted.

An argument specifies how many should be started by the one you’re running.

Documentation: man page Source code: restricted Notes: (1) Just like afsd, there are multiple invoca-

tions (6 on the RS/6000, 4 everywhere else) so that multiple requests can be handled simultaneously. (2) Also just like afsd the processes actually just start up and hang a system call. (3) Starting more than four biods doesn’t do any good on the VAX or RT.

console

Stands for: just what it says

Path: /etc/athena/console

Platforms: all Started by: dm Purpose: Displays output of workstation console and

user X session. Life cycle: If killed, restarted by dm – that’s how config console

works. Documentation: man page

Source code:  /source/athena/athena.etc/xdm/console

Notes: Runs as daemon because it doesn’t have to run as root.

cron

Stands for: Possibly named after “cron,” the Greek

word/root for “time.”

Path: /etc/cron

Platforms: all Started by: init on the RS/6000, rc otherwise Purpose: Executes processes at specified times/dates

based on configuration files. Life cycle: Can be killed and restarted safely. On the

RS/6000, will restart automatically; on other platforms, must be restarted by hand.

Documentation: man page Source code: restricted

dm

Stands for: display manager

Path: /etc/athena/dm

Platforms: all Started by: inittab on RS/6000, ttys otherwise Purpose: Handles X login sessions. Starts the X server,

the console, and the xlogin program. Life cycle: Can be killed and will restart automati-

cally. However, if you kill it when you’re logged in, you’ll probably get logged out!

Documentation: man page

Source code:  /source/athena/athena.etc/xdm/dm

inetd

Stands for: Internet daemon

Path: /etc/inetd

Platforms: all Started by: rc.tcpip on the RS/6000, rc otherwise Purpose: Controls daemons for network protocols, such

as telnet, rlogin, talk, etc. Life cycle: Can be killed and restarted safely. Network

processes running when you kill it shouldn’t die, but new connections can’t be initiated until you restart it.

Documentation: man page Source code: restricted, but see /mit/jik/src/inetd

for something sort of like the Athena version, or

/afs/athena/astaff/reference/bsd-network-2/usr.sbin/inetd

for something like the RS/6000 version.

Notes: The version running on the VAX, RT and DECstation workstations has Athena hacks to allow access on and access off to work. The RS/6000 version doesn’t support that yet, which is why remote access to RS/6000’s is disabled in 7.3

init

Stands for: Probably “initializing process” or something like that. Possibly from “Initializer.SysDaemon” from Multics.

Path: /etc/init

Platforms: all

Started by: kernel

Purpose: Runs startup script, then runs login processes and (on the RS/6000 and other System V-like systems) certain daemons.

Life cycle: Sending it certain signals will cause it to reread its configuration file, go into single-user mode, or do other special things. If it dies, the system will reboot.

Documentation: man page

Source code: restricted

named

Stands for: name daemon

Path: /etc/athena/named on RS/6000, /etc/named oth-

erwise Platforms: all Started by: rc.athena on RS/6000, rc otherwise Purpose: Internet domain name server. Host name

resolution, hesiod lookups, etc. Life cycle: Can be killed and restarted, but don’t leave

it dead for long or you’ll probably run into trouble (e.g. “attach” will have trouble)

Documentation: man page

Source code:  /afs/athen/astaff/reference/bsd-network-2/usr.sbin/named

Notes: The version in /etc/named on the RS/6000 is the IBM version, which we don’t use.

snmpd

Stands for: simple network management protocol daemon

Path: /etc/snmpd on the RS/6000, /etc/athena/snmpd

otherwise Platforms: all Started by: rc.tcpip on the RS/6000, rc otherwise Purpose: Allows remote queries of the workstation to

determine information such as disk sizes and space used, workstation type, workstation load, workstation version. Example: cview uses SNMP to check for free workstations.

Life cycle: Can be killed and restarted safely Documentation: man page Source code: restricted Notes: The version running on the RS/6000 is the

IBM version, which does not support all of the queries that the Athena version supports.

syslogd

Stands for: syslog daemon

Path: /etc/athena/syslogd on VAX and RT, /etc/syslogd

on RS/6000 Platforms: Athena-specific version on VAX and RT,

BSD 4.3 version on RS/6000, none on DECstation (which uses syslog instead).

Started by: rc.tcpip on RS/6000, rc otherwise Purpose: Handles logging of messages from various

other daemons and processes. Life cycle: Can be killed and restarted safely. Documentation: man page

Source code:  /source/athena/athena.lib/zephyr/clients/syslogd
for the Athena version, /afs/athena/astaff/reference/bsd-network-2/usr.sbin/syslogd
for the BSD version.

Notes: The Athena version is special because it knows how to do logging over Zephyr, to individuals or to instances of class “syslog.”

timed

Stands for: time daemon

Path: /etc/athena/timed

Platforms: all Started by: rc.athena on the RS/6000, rc otherwise Purpose: Time synchronization daemon. Time is oc-

casionally updated by the master time daemon for the subnet.

Life cycle: Can be killed and restarted safely. If you leave it dead for too long, your clock may drift too far and you will have trouble using Kerberos and other things.

Documentation: man page Source code: Restricted, but attach aeneas:ftp and

see /aeneas/ftp/pub/misc/timed.tar.Z.

Notes: This daemon is what causes the “this machine is a slave” and “time set by” messages in workstation logs.

update

Stands for: just what it says

Path: /etc/update

Platforms: all except RS/6000 Started by: rc Purpose: Periodically does a sync system call to force

dirty disk buffers to disk. Also, on the VAX and RT, opens certain directories and keeps them open so that they will remain in the directory cache for faster access.

Life cycle: Can be killed and restarted safely. Not a good idea to kill it and leave it dead, because if your workstation crashes you might lose more work.

Documentation: man page Source code: restricted, but trivial Notes: The RS/6000 has an update shell script, but

we appear to actually use syncd instead.

Stands for: X server Path: /usr/bin/X11/X on the RS/6000, /etc/X other-

wise Platforms: all Started by: dm Purpose: X server. Life cycle: Restarted each login cycle. Documentation: man page, in the x11r4 or x11r5

locker if nowhere else Source code: x111r4 locker Notes: The RS/6000 server is based on X11R3 rather

than X11R4, and we don’t have source for it.

zhm

Stands for: Zephyr hostmanager

Path: /etc/athena/zhm

Platforms: all Started by: rc.athena on RS/6000, rc otherwise Purpose: Handles communication between worksta-

tion Zephyr clients and the zephyr servers. Life cycle: Can be killed and restarted, but doing so

will confuse running Zephyr clients, including zwgc losing subscriptions.

Documentation: man page

Source code:  /source/athena/athena.lib/zephyr/zhm

Special processes created by the kernel: • pagedaemon (not on the RS/6000)

• swapper

• idleproc (DECstation only)

• kproc (RS/6000 only)

DECstation-specific processes:

• syslog
• elcsd

RS/6000-specific processes:

• qdaemon
• srcmstr
• syncd
• writesrv
• portmap
• rpc.lockd, rpc.statd
• errdaemon