What happens when you type ls -l in the shell?

4 min readApr 14, 2020

If there is something that makes me very happy of working on Shell, it’s how intuitive its commands can be, and ls is not the exception.

First of all you need to know that the ls command will list the content of a folder, if we don’t specify it, it will do it in the directory where we are currently.

But what happens then with the “-l” ? Ok, let’s see: In Unix many commands have something called “flags”. This flags will affect the behavior of the commands; like some extra or advanced functions. In the case of -l, this one displays detailed information about the files. Permissions, number of inodes, file owner, group the file belongs to, file size in bytes, file’s last modification date and file name.

We can distinguish a flag by two essential attributes:

1. It goes after a command.

2. It always starts with a dash “-”.

Now that we have the general idea, let’s go deeper and get a little bit more technical, and for this, first we need to know the heart of our machines.

The kernel:

It’s a program that works as a bridge, linking the software with the hardware,
It is in charge of managing resources, through system call services.

Kernel functions:

Memory management for all running programs and processes.
Processor time management that running programs and processes use.
The communication between the programs that request resources and the hardware.
Management of the different computer programs (tasks) of a machine.
Hardware management (memory, processor, peripheral, form of storage, etc.).

What’s going on down under!?

When we start our shell we will see the prompt (“username@hostname:~$” on Linux). This is the shell’s way of telling us, “Hey! Write some commands here”, so… Let’s try it with “ls -l”.

The shell reads the command with a function called “getline” as arguments and performs a routine check.

Alias!

The shell reads the “ls” and verifies if a matching alias exists, if it does, it replaces it with its value, if not…

Shell expansion :

Is when a symbol or character expands into larger text, files or any other output (wildcards),

Command execution:

The shell looks if the command exists as a built-in function.

Let’s see the environment:

Finally here we are, in the process that interests us; the “environment”. It’s an array that contains the information of some variables necessary for the operation of the system, one of them is “$PATH”.

As you can see, $PATH contains some paths(separated by colons “:”), in these, the shell will search for our command’s corresponding program.

Now, the “ls”command matches an executable with the same name on the path “/usr/bin”, Now we execute this program and the shell will make 3 system calls.

Fork:

Everytime we execute a command the system creates a new process, and this new one is known as “child process” (Cute right?). That’s because it’s a duplicate of the “parent process” which in this case is the shell.

Execve:

When we run a program (like “ls) we will initialize a new stack and a new heap, basically all our previous data will be destroyed, and that’s why we create a duplicate, to run our programs on the child without affecting our parent.

This system call makes three steps:

Stops the child process.
Loads the new program
Executes the new program

Wait:

As its name says, the parent will wait until the child exits or receives a signal.

At the end of the process, once our command is fully executed, the shell frees the memory used for the child process, exits from the child and returns to the prompt ready to execute a new command.