关于init进程是否运行于内核空间及Linux内核空间进程的疑问

Hey there! As someone who was also confused about this when I first started with Linux, let's break this down clearly for you.

哪些"进程"运行在内核空间？ #

First, a quick correction: there are no traditional user-space processes running in kernel space. What runs there are kernel threads—these are part of the kernel itself, designed to handle low-level system tasks like hardware management, memory swapping, and interrupt handling. They don't have a user-space address space and execute entirely in kernel mode.

To see kernel threads on your system, run this command:

ps -ef | grep \[

You'll see entries with names wrapped in square brackets, like:

• kthreadd: The parent of all kernel threads
• kswapd0: Handles memory page swapping when RAM is low
• jbd2/sda1-8: Manages filesystem journaling
• irq/16-nvidia: Handles hardware interrupts for your GPU

Is init (or systemd) running in kernel space? #

Short answer: No, init (and its modern replacement systemd, which is now the default on most distros) runs entirely in user space.

Your confusion makes total sense—after all, it's the first program that starts up the whole system! But to understand why it's in user space, let's walk through the Linux boot process briefly:

1. When you turn on your computer, the BIOS/UEFI loads the Linux kernel into memory and starts it.
2. The kernel initializes itself: it detects hardware, sets up memory management, starts the process scheduler, and does all the low-level groundwork. At this point, there are no user-space processes running.
3. The kernel mounts the root filesystem, then loads and executes the first user-space program—this is PID 1, which is init (or systemd).
4. From there, init takes over: it starts all the user-space services, daemons, and eventually the login manager so you can interact with the system.

Think of it this way: the kernel is the "engine room" of the system, handling all the critical, low-level work. Init is the "floor manager" in the user space, coordinating all the user-facing services. It doesn't need to be in kernel space because its job is to manage other user-space programs, not directly manipulate hardware or kernel resources.

A quick way to verify #

Run this command to check the state of PID 1:

ps -p 1 -o comm,state,addr

The addr column will show a user-space address range (or 0000000000000000 on some systems), confirming it's running in user space. Kernel threads, by contrast, will show kernel-mode addresses here.

内容的提问来源于stack exchange，提问作者Bruce Wayne