Terminal usage in Tron Legacys Board Room

Last night I rewatched one of my favourite movies of all time: Tron Legacy. I know… it’s not everyones cup of tea as the story is a bit lacklustre. But I’m mainly in it for the soundtrack, the visuals and the atmosphere.

Right at the beginning we are presented with a scene of Encoms board room. Encom in this case being the money-hungry corporation dominating the global operating system market.

We proceed to watch our protagonist hacking their newest and unreleased operating system and everyone starts to panic. At this point one of the board members by the name of Ed Dillinger whips up a terminal and kills the hacking process.

And this is the part that really intrigued me.

Not having paid much attention to process management in the terminal in the past, I knew my work was cut out for me.

1 Listing the relevant processes

The first command I noticed is this one

$ ps -ef | grep -i os12

Having a basic understanding of how to structure terminal commands and how to chain them, I identified 3 main components to the command.

1. Pipe operator
2. Process status command
3. Grep command

Try hovering the list items to highlight the corresponding code.

1.1 Pipe operator

I decided to start with the pipe operator as this is something I’m somewhat familiar with. In essence the pipe operator takes the output of the command on it’s left (in this case ps -ef) and uses it as the input to the command on it’s right (grep -i os12)

1.2 ps -ef command

The ps command, according to it’s man page stands for “Process Status”.

The ps utility displays a header line, followed by lines containing information about all of your processes that have controlling terminals. ¹

The -e does the same as the -A flag, which will display information about other users’ processes, including those without controlling terminals.

This makes sense: Currently they are being hacked, so there is a good chance they are not the user executing this process.

The -f flag displays the uid, pid, parent pid, recent CPU usage, process start time, controlling tty, elapsed CPU usage, and the associated command.

So to summarise, this command ps -ef finds all the processes and includes additional information like where it originated, how active it is and what triggered it!

1.3 grep -i os12 command

When running man grep it will tells me that grep is a file pattern searcher.

Tbh. I knew that part…

But it also tells me:

The grep utility searches any given input files, selecting lines that match one or more patterns. By default, a pattern matches an input line if the regular expression (RE) in the pattern matches the input line without its trailing newline. ²

While already looking at the man page for the grep utility, I also looked up the -i or --ignore-case flag. As the name suggests, it ignores the case.

So grep -i os12 takes a given input file and searches for lines that contain a case-insensitive version of the os12 string.

1.4 Putting it together

To summarise this:

1. ps -ef takes all the processes currently running and returns them as well as their origin and additional information.
2. | then passes this output, which is a set of lines, similar to files to the next command
3. grep -i os12 takes a given file (or in our case a file-like set of lines) and searches for the case-insensitive version of os12.

Giving us the following output.

$ ps -ef | grep -i os12
tmd  17319 17308 81 17:39 pts/2 00:17:00 /ho...
root 18458 18456  0 18:00 pts/4 00:00:00 /bi...

Which relate to the following column headers: UID, PID, PPID, C, STIME, TTY, TIME, CMD.

2 Killing the relevant process

After identifying the relevant processes in question, we see a kill command being executed.

$ kill -9 17319

Similar to before, we can bring up the manpages for the kill command:

The kill utility sends a signal to the processes specified by the pid operands. ³

[…]

9 KILL (non-catchable, non-ignorable kill)

So following this logic the command with the id 17319 is being killed and this can’t be ignored by the process.

Good to know