Subshell Command Execution

Question

I'm reading the bash manual and came to a section that states:

"Command substitution, commands grouped with parentheses, and asynchronous commands are invoked in a subshell environment that is a duplicate of the shell environment"

My question is, is there a way I could actually see what was executed in the subshell. For example say I wrote the line below. What would I need to do to actually see what was executed in the subshell?

$ printf "first\nsecond\nthird" | grep -E "(first|second)"

How would I check what was actually executed in the subshell (i suspect it does a grep for "first" and then a second shell to grep for "second", but I'd just like to see what it's doing).

Answer 1

I don't think you can see it directly.

xtrace (set -x) does show nesting level for evals and command substitutions, but not for groups in parenthesis.

Bash runs subshells in child processes, so in principle you could try to run strace or similar to see the fork() (clone() on Linux) and execve() system calls the shell and it's children make, but the output is a bit hard interpret. Also, builtins like that printf there don't show up in execve() calls, and when a Bash process only has one command to run, it skips one level of forks. E.g. bash -c '/bin/false' doesn't fork for the external command, and similarly (/bin/false) only has one fork for the subshell, not two for subshell and external command.

You could also print $BASHPID in various places it compare it to $$. $BASHPID contains the PID of the Bash process actually running at the time while $$ contains the PID of the main Bash process and doesn't update for subshells. Though it doesn't show you the commands that are run, and sprinkling those printouts is a bit messy:

$ echo $$ >&2; { echo "lhs: $BASHPID" >&2; printf foobar; } | { echo "rhs: $BASHPID" >&2; grep oo; }
30163
rhs: 30166
lhs: 30165
foobar

Yes, we can tell from the output that both parts of a pipeline run in subshells, even though that wasn't mentioned in the part you quoted.

Anyway, what runs in subshells is mostly those, the three your quote mentiones, plus pipelines.

Async/background processes are obvious: they run at the same time as the shell, so they can't be in the same process. The parts of a pipeline also have to run concurrently, so at most one can run in the main shell process. (In Bash, the rightmost part will do that if the lastpipe option is set and effective, otherwise they all get their own subshells/processes.)

Parenthesized groups explicitly ask for a subshell, and well, I can't think of an excuse for command substitutions, so I guess we'll just have to accept they also do.

Changes in a subshell don't propagate up to the main shell, so it's also relatively simple to test this. E.g. if you run:

bash -c 's=
         s+=direct.
         (s+=parens.)
         $(s+=comsub.)
         s+=pipeleft. | s+=piperight.
         s+=async. &
         eval s+=eval.
         echo $s'

You get the output direct.eval., so those are the parts that didn't run in subshells. The rest did. If you add -O lastpipe before the -c, or shopt -s lastpipe; within the script, you'll also see piperight added to the list.

Answer 2

First I am not sure grep exec is in two subshells.

But to check what happen when you exec the command you can use command truss. Something like:

printf "first\nsecond\nthird" | truss -o out.log grep -E "(first|second)"

will store in out.log the system calls, the signals, etc command do.

Here is the man page of truss for future reference.

About strace I think you can replace it in the command:

printf "first\nsecond\nthird" | strace -o out.log grep -E "(first|second)"

but be aware the output will differ, compared to truss

If you want to trace the entire shell, subshell creation, syscalls, etc you should use command in format:

strace -o out.log 'printf "first\nsecond\nthird" | grep -E "(first|second)"'