PF_KTHREAD value is visible via field number 9 of /proc/*/stat $ sudo cat /proc/2/stat 2 (kthreadd) S 0 0 0 0 -1 2129984 0 ... ^^^^^^^ It is used by at least systemd to check for kernel-threadness: https://github.com/systemd/systemd/blob/main/src/basic/process-util.c#L354 src/basic/process-util.c:is_kernel_thread() It means that the value can't be changed despite perceived notion that task_struct flags are internal to kernel and can be shuffled at whim. Formally, _all_ struct task_struct::flags PF_* values are kernel ABI which is a disaster. I hope we can mask everything but few flags and hope for the best :^) Note for beginner Linux programmers: every other way you find on the interwebs and Stack Overflow for checking if pid belongs to a kernel thread is broken one way or another. Signed-off-by: Alexey Dobriyan <adobriyan@xxxxxxxxx> --- include/linux/sched.h | 3 +++ 1 file changed, 3 insertions(+) --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -1566,6 +1566,9 @@ extern struct pid *cad_pid; #define PF_MEMALLOC_NOIO 0x00080000 /* All allocation requests will inherit GFP_NOIO */ #define PF_LOCAL_THROTTLE 0x00100000 /* Throttle writes only against the bdi I write to, * I am cleaning dirty pages from some other bdi. */ +/* + * PF_KTHREAD is part of kernel ABI, visible via value #9 in /proc/$pid/stat + */ #define PF_KTHREAD 0x00200000 /* I am a kernel thread */ #define PF_RANDOMIZE 0x00400000 /* Randomize virtual address space */ #define PF_SWAPWRITE 0x00800000 /* Allowed to write to swap */
