cite from: http://turnoff.us/geek/inside-the-linux-kernel/
1. The foundation is a file system. PID 421 is accessing files, while a watch dog is monitoring the whole file system.
2. On the first floor, we can find a process table, the “mom” is PID 1. PID 1341(apache http) for port 80, PID 52 for ssh(22), and nobody for expired FTP(21). Also there are some others, like wine, pipes, cron and a hacker closing to the watch dog. PID in this floor can go upstairs to IO or down stairs to access file system.
3. Go upstairs, two pids are responsible to input and output(tty)