Reattaching Disowned Processes In Linux And Unix

In Linux and Unix operating systems, processes can become “disowned” from their controlling terminals. This often happens unintentionally when using job control features of shells like Bash. Disowned processes continue running in the background, but they no longer accept signals from the shell. This article explains what disowned processes are, how to find them, and how to reattach them to regain control.

Understanding Process Disowning in Bash

The Bash shell allows disowning running processes using the “disown” built-in command. Disowned processes differ from stopped or background jobs in a few key ways:

Disowned processes keep running even when their parent Bash shell exits
Disowned processes do not receive SIGHUP signals when their controlling terminal closes
The shell does not display disowned jobs status updates on the terminal
Disowned jobs can no longer be managed with Bash job control commands like fg, bg, and kill

The “nohup” command also disowns processes by detaching them from the controlling terminal entirely. The key difference is nohup protects disowned processes from SIGHUP signals too.

Table of Contents

When Processes Are Disowned By Default

There are a few instances where Linux and Unix systems will automatically disown processes:

When closing SSH connections, the processes keep running on the remote system disowned from the terminal
Running graphical applications like gedit will disown them from the starting terminal
Ending a terminal session with background jobs disowns them from the closed terminal
Some system services daemonize processes, disowning them from terminals

In most shells like Bash, background processes and jobs started with & or Ctrl+Z are not disowned automatically. Disowning requires explicit use of the disown command.

Finding Disowned Processes with ps

The first step to reattaching disowned processes is locating them on the system. The ps command shows information about running processes and can help identify disowned ones.

Disowned processes have no controlling terminal associated with them. Running ps -ef displays the controlling terminal for processes as the TTY column:

$ ps -ef
UID   PID  PPID   TTY    TIME CMD
user 1592    64   pts/0  00:00:01 bash
user 2134 1592    ?    00:00:00 ps -ef

Here process 2134 launched from terminal pts/0 is disowned with no TTY shown. But 1592 is Bash attached to pts/0.

You can also spot disowned background jobs still running with ps. Their STAT column shows status “D” for disk sleep:

$ ps
  PID TTY          TIME CMD
 4241 pts/1    00:00:00 bash
 4386 pts/1    00:00:00 sleep 30 &
 4387 pts/1    00:00:00 ps
    
$ disown -h 4386

$ ps
  PID TTY          TIME CMD    
 4241 pts/1    00:00:00 bash
 4386 ?      00:00:00 sleep 30

After disowning, process 4386 no longer associates with a TTY.

Reattaching Disowned Processes with fg

The foreground job control command fg can reattach disowned processes to the terminal if you know the process ID (PID).

Running fg PID brings the process with ID PID back into the foreground on the current terminal:

$ fg 4386 
sleep 30
^Z
Suspended

Now sleep has been foregrounded and stopped with control Z suspending it.

Example Reattaching a Disowned Process

For example, to reattach a disowned long running process:

# Start process
$ sleep 3000 & 
[1] 8192
 
# Disown background job 1
$ disown -h %1
 
# Find PID and reattach
$ ps
  PID TTY          TIME CMD
 8192 pts/1    00:00:00 sleep 3000
 
$ fg 8192
sleep 3000
^CTerminated

The job was started, disowned, found with ps, and finally reattached with fg before terminating it.

Reattaching Disowned Processes by PID

If you know the PID of a disowned process already, you can combine steps and reattach in one go:

$ sleep 3000 & 
[1] 8999
$ disown -h %1
 
$ fg 8999
sleep 3000 
^CTerminated

This method is useful when processes become disowned accidentally without recording their PID first.

Risks of Leaving Processes Disowned

Although disowned processes keep running after detaching from terminals, leaving them disowned poses some risks:

No shell control over resources usage like CPU and memory
Orphaned processes if parent shell exits
No signals received from shell (SIGINT, SIGTERM, etc)
Possible security issues depending on process permissions

That’s why it’s usually best practice to find and reattach disowned processes even if they will run fine disowned.

Monitoring Disowned Processes

If you choose to leave processes disowned, you should still monitor them periodically with ps since Bash job control is no longer managing them.

Check if any unfamiliar or unintended processes are eating resources. Also ensure long running processes are still active as expected.

Watch specific disowned process stats with top or htop by filtering by PID or command name.

Setting up periodic monitoring cron jobs running ps also helps keep track of disowned processes.

Kill Disowned Processes Safely

If kill signals have no effect when sent from Bash, use pkill or killall to terminate disowned processes instead:

$ sleep 3000 &
$ disown %1
 
$ kill 8192
-bash: kill: (8192) - No such process
 
# Kill by name 
$ pkill -f sleep

pkill and killall both leverage process names to match PIDs safely. This allows force killing disowned and orphaned processes unresponsive to regular Bash job control.