PF_KTHREAD value is visible via field number 9 of /proc/*/stat
$ sudo cat /proc/2/stat
2 (kthreadd) S 0 0 0 0 -1 2129984 0 ...
^^^^^^^
It is used by at least systemd to check for kernel-threadness:
https://github.com/systemd/systemd/blob/main/src/basic/process-util.c#L354
src/basic/process-util.c:is_kernel_thread()
It means that the value can't be changed despite perceived notion that
task_struct flags are internal to kernel and can be shuffled at whim.
Formally, _all_ struct task_struct::flags PF_* values are kernel ABI
which is a disaster.
I hope we can mask everything but few flags and hope for the best :^)
Note for beginner Linux programmers:
every other way you find on the interwebs and Stack Overflow
for checking if pid belongs to a kernel thread is broken one way or
another.
Signed-off-by: Alexey Dobriyan <adobri...@gmail.com>
---
include/linux/sched.h | 3 +++
1 file changed, 3 insertions(+)
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1566,6 +1566,9 @@ extern struct pid *cad_pid;
#define PF_MEMALLOC_NOIO 0x00080000 /* All allocation requests will
inherit GFP_NOIO */
#define PF_LOCAL_THROTTLE 0x00100000 /* Throttle writes only against
the bdi I write to,
* I am cleaning dirty pages
from some other bdi. */
+/*
+ * PF_KTHREAD is part of kernel ABI, visible via value #9 in /proc/$pid/stat
+ */
#define PF_KTHREAD 0x00200000 /* I am a kernel thread */
#define PF_RANDOMIZE 0x00400000 /* Randomize virtual address
space */
#define PF_SWAPWRITE 0x00800000 /* Allowed to write to swap */
