If I have following Libvirt hook in /etc/libvirt/hooks/qemu.d/hook.sh

#!/usr/bin/env bash

if [[ $1 == "SEARCH_FOR_ME" ]]; then
    while true; do
        sleep 1
    done
fi

bash /etc/libvirt/hooks/qemu.d/hook.sh SEARCH_FOR_ME &
disown $!

touch /tmp/test123

exit 0

Now when I start any of my VMs this hook gets called and what I expected to happen is that a new process will be spawned and will run alongside VM. What actually happens is that libvirt for some reason knows that forked process is still running. Note that /tmp/test123 is being created. It seems that original bash script is being suspended.

2438 root        20   0     0     0     0 Z   0.0  0.0  0:00.00 bash
 2439 root        20   0  4396  3200  2944 S   0.0  0.0  0:00.04 bash /etc/libvirt/hooks/qemu.d/hook.sh SEARCH_FOR_ME

Also while running the same hook in my terminal I can't observe the same behavior. nohup works the same way and doesn't fix this issue. My system:

Artix Linux (OpenRC 0.53)
Hyprland WM (Wayland)
Libvirtd + Virt Manager

Operating System Concepts and APUE say > With vfork(), the parent process is suspended, and the child process uses the address space of the parent. Because vfork() does not use copy-on-write, if the child process changes any pages of the parent’s address space, the altered pages will be visible to the parent once it resumes. Therefore, **vfork() must be used with caution to ensure that the child process does not modify the address space of the parent.** > **vfork() is intended to be used when the child process calls exec() or exit() immediately after creation.** How shall I understand the last sentence? When a child process created by vfork() calls exec(), doesn't exec() modify the address space of the parent process, by loading the new program? When a child process created by vfork() calls exit(), does exit() not modify the address space of the parent process when terminating the child? I have preference to Linux. Thanks.

*The vfork () system call has the same effect as fork(), except that the page table entries of the parent process are not copied.Today, with copy-on-write and child-runs-first semantics,the only benefit to vfork() is not copying the page table entries.If Linux one day gains copy-on-write page table entries,there will no longer be any benefit.* These are some lines from Robert Love's book on 'Linux Kernel Development'.What I don't understand is what is the benefit of not copying the page table entries? There is also a line which says,"*In copy_process(),the task_struct member vfork_done is set to NULL*". What is this **vfork_done**? What is its function?

I am trying to check what really happens to pthreads while one of them performs vfork. The spec says that the parent "thread of control" is "suspended" until the child process calls exec* or _exit. As I understand, the consensus is that it means that the whole parent process (that is: with all of its pthreads) is suspended. I'd like to confirm it using an experiment. So far I performed several experiments, all of which suggest that other pthreads are running. As I have no linux experience, I suspect that my interpretation of these experiments is wrong, and learning the real interpretation of these results could help avoid further misconceptions in my life. So here are the exepriments I did: **Experiment I** #include #include #include #include #include #include using namespace std; void * job(void *x){ int pid=vfork(); if(-1==pid){ cerr << "failed to fork: " << strerror(errno) << endl; _exit(-3); } if(!pid){ cerr << "A" << endl; cerr << "B" << endl; if(-1 == execlp("/bin/ls","ls","repro.cpp",(char*)NULL)){ cerr << "failed to exec : " << strerror(errno) << endl; _exit(-4);//serious problem, can not proceed } } return NULL; } int main(){ signal(SIGPIPE,SIG_IGN); signal(SIGCHLD,SIG_IGN); const int thread_count = 4; pthread_t thread[thread_count]; int err; for(size_t i=0;it[] should be back to the initial state (which by definition is all zeros). If entering the child process freezes the other pthreads making them unable to call vfork until current child finishes the loops, then the array should be all zeros at the end. And I confirmed that when I use fork() instead of vfork() then the above code does not produce any output. However, when I change fork() to vfork() I get tons of inconsistencies reported to stdout. **Experiment III** One more experiment is described here https://unix.stackexchange.com/a/163761/88901 - it involved calling sleep, but actually the results were the same when I've replaced it with a long for loop.

In [this answer](https://stackoverflow.com/questions/49988/really-killing-a-process-in-windows) user suggests that > Normally, Uninterruptible sleep should not last long, but as under windows, broken drivers or broken userpace programs (vfork without exec) can end up sleeping in D forever. How can userspace program really lock up in D on non-buggy kernel? I though it's sort of little vulnerability for usermode to be able to stuck in D on purpose...