I'm confused about the getppid
syscall in linux.
Does it return the pid of the process that spawned it or the current parent (which could be different if the original parent exited)?
getppid
returns the pid of the parent process at the time of the call. If a process is reparented (eg: through an explicit syscall to do so or because the parent process exited), the value returned will change accordingly.