What happens when you type `ls -l *.c` in the shell

What is the shell?

Linux shell structure

The shell is the command interpreter in an operating system such as Unix or GNU/Linux. Is a program that executes other programs. It provides an interface for a computer user to the Unix/GNU Linux system so that the user can run different commands or utilities/tools with some input data.

By default, the list is sorted alphabetically. You have the option to sort it however you will want to use different options along with it. The command man ls shows the manual page ofls within the terminal. This lists all the different options that can be used in conjunction with ls for more advanced uses.

So, let us start by splitting the ls -l *.c . ls stands for the list, so by using ls alone you will be able to view the list of the files and directories in the current working directory.

ls command

The -l option signifies the long list format. This shows a lot more information presented to the user than the standard command. You will see the file permissions, the number of links, owner name, owner group, file size, time of last modification, and the file or directory name.

This option is used in conjunction with many other options on a regular basis. An asterisk (*) (is one of the wildcards in Linux also referred to as meta characters)matches one or more occurrences of any character, You can use it with ls command to list files matching given criteria, like in our case we need to list all files ending with .c extension.

Files with a .c extension

Now, what happens when you type ls -l *.c in the shell? In between the moment you hit Enter and the files are listed, several steps are taken behind the scenes.

step1: When the command ls -l *.cis keyed in, the keyboard driver recognizes that characters have been entered and parses them to the shell, the shell reads it from the getline() function’s STDIN. Once the command is stored, it is passed through the strtok() function. This function, present in <string.h> allows us to separate the string by the assigned delimiter, in our case assigning the space as the delimiter, so that each command is stored in separate memory spaces and arguments can be evaluated. This whole process is termed Tokenization.

step2: Now that we have a tokenized array, then we will have to search if each token has an alias defined. If an alias is found, it is saved as a token after removing the spaces like before, and again it's checked for aliases. Usually, the alias is stored in the following locations : ~/.bashrc, ~/.bash_profile, /etc/bashrc,/etc/profile.

Next is to check if each token is a built-in function. If the command is built-in, the shell executes the command directly, without invoking another program. cd is a built-in command for example whereas ls is not built-in, Hence a system needs to find the executable for ls.

step3: The first search for the command ls is performed at $PATH. $PATHis an environmental variable that stores the path locations of all the common executable programs. This search is performed by calling a series of functions like find_user_command(), find_user_command_in_path(), find_in_path_element() Each location specified in the PATHvariable is searched for the executable corresponding to the command ls.

step4: Now we have all those pieces of information, we have to execute the command. To do so, we have to use the execve and fork system calls.


Executes the program referred to by pathname. This causes the program that is currently being run by the calling process to be replaced with a new program, with newly initialized stack, heap, and (initialized and uninitialized) data segments.


int execve(const char *file, char *const argv[], char *const envp []);


A system call that is used for creating a new process, which is called child process, runs concurrently with the process that makes the fork() called (parent process). After a new child process is created, both processes will execute the next instruction following the fork() system call. A child process uses the same (program counter), same CPU registers, same open files which is used in the parent process.

It takes no parameters and returns an integer value. Below are different values returned by fork().

(-) Negative Value: the creation of a child process was unsuccessful.

(-) Zero: Returned to the newly created child process.

(-) Positive value: Returned to parent or caller. The value contains the process ID of the newly created child process.

System calls are used for basic process management.

The parent process uses forkto create a new child process. The child process is a copy of the parent. After that, both parent and child executes the same program but in separate processes. The execreplaces the program executed by a process. The child may use exec after a fork to replace the process’ memory space with a new program executable making the child execute a different program than the parent. The exitterminates the process with an exit status. The parent may use wait to suspend execution until a child terminates. Using wait the parent can obtain the exit status of a terminated child.

Therefore In our case, the input to the execve will be :

execve("/bin/ls”, {"/bin/ls", "-l", NULL}, NULL);

How does ls read directories and files from disk?

Well, a list of functions is executed internally to achieve the final output. The ls utility uses a function to read the directory contents, which in turn invokes a system call to read the list of files in the directory by consulting the underlying filesystem’s inode entries. Depending on which filesystem the path specified to ls is formatted, the function used to read the directory contents may vary. So once all the entries have been retrieved, the system call returns the list of files to the prompt. The prompt is printed again. The prompt is saved as the environment variable PS1.

Generally, this is the process that applies to all commands in the shell terminal.


Mildred Makori

Michael Kipkemboy

And finally, thanks for reading this article. Let us know what you think in the comments box!



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Mildred Makori

Mildred Makori

A Software Engineer Student at ALX (Holberton) | Technical Writer