What happens when you type ls -l in the shell

Kevin Apostol
5 min readNov 21, 2019

--

The ls -l is a Linux shell command that lists directory contents of files and directories in a long format. That's as simple as it! Okay, let's talk about what happens behind the scenes and how does this command work.

Linux System Organization

The kernel is the central, most fundamental part of the computer operating system. It controls the programs of a computer while talking to the hardware and software that is highly involved in resource management. Lastly, the hardware holds the processor (CPU), main memory (RAM), controls interfaces, disks, ports, and more. The user interface is by means that that the user interacts in particular use of input devices and software.

According to Wikipedia, a Unix shell is a command-line interpreter or shell that provides a command-line user interface like operating systems. This is where we run the ls -l command. Impressive, isn’t it?

Unix Shell

So what happens when you type ls -l and hit enter in the shell?

The first thing you see is that the shell prints a prompt, prompting the user to input commands (see Unix Shell) and always ends with a $ sign. Here we can enter our command/s, in this case, we input ls -l.

Behind the scenes

Get User Input

The first thing the shell does is getting the user’s input, then parses the input then breaks it to tokens. Imagine you have a pizza, you slice it to get eight slices. In the shell’s case, it gets input as a sentence and tokenizes (slices) it into words.

Check for Expansions and Alias

After breaking it into tokens (words). The shell does expansion which checks for special characters that need to be expanded an example *.c will be replaced with all the .c files in the current working directory.

Shell also checks for aliases (an alias is similar to a keyboard shortcut). If lsis an alias, the shell will `replace ls with its corresponding value. Say we set up an alias called light: alias light="echo". If we enter light “Hello World"our command will be processed as echo “Hello World".

Check Builtins

If ls is not an alias, the shell will then check whether the command ls is a built-in command. A built-in command is a command that is built into and executed on the shell itself. The shell executes the command directly, without invoking another program. Builtin commands are necessary to implement functionality impossible or inconvenient to obtain with separate utilities.

Environment Variable & PATH

An environment contains environment variables that provide information about system behavior. Shell login maintains an environment in which you can run programs. If we try to inputenv on the command line, a list of environment variables is displayed to you.

If ls is not a builtin, The shell will look to an environment variable called PATH.

First, it gets a value PATH and copies it. Then the copy will be tokenized that are separated by : with each token represents a directory.

A copy is necessary here because we don’t want to alter PATH. We can destroy a copy of PATH into tokens to check with the entered command.

Now shell will append/ls(slash + tokenized input) to the end of each directory that was tokenized in PATH to check whether or not the file exists.

After searching through each token, and there is no file ls existing, the shell will then throw an error.

fork(), execve(), wait()

Every application comes into execution through means of the process. A process is a running instance of a program.

Firstly before we use fork(), execve(), and wait() for the shell to let’s talk more about these three functions.

fork() creates a new process by duplicating the calling process. The new process, referred to as a child, is an exact duplicate of the calling process, referred to as the parent.

execve() executes the program pointed to by filename. filename must be either a binary executable or a script starting with a line of the form #! interpreter [optional-arg].

And lastly, wait() is that the parent process remains until the child completes its execution, then it can resume.

The shell uses these three functions together if the file exists.

  • Fork gets invoked a copy of the parent process called child. The child process has a method. Thus it also has its process ID. Using having a copy, we can then isolate this operation as a subprocess. In our case, we use it to execute our command/s
  • The child process then invokes execve() to run the user’s command,ls in our case, gets run. execve() will replace the current process with the program it calls. ls, in this case.
  • The parent process waits until the child completes its execution via wait(). The parent process resumes its work by running and waits for the user to input another command.

--

--