I think the interviewer was looking for information on how the shell creates child processes and what sys calls might be involved in running ls. The shell executes a stat syscall looking for file named ls in all paths included in the PATH environment variable. Once ls is found, the shell forks and execs the ls binary with the arguments -l and the expansion of the glob for *.txt, so multiple file names might be included, e.g. 1.txt, 2.txt etc, in the ls -l arguments. The expansion is probably done internally by the shell, depending on the shell, using a call to readdir or getdents, looking for files that match the glob in the cwd. ls then calls stat, or one of the stat family of syscalls, on each entry passed to ls to retrieve metadata from the file's inode. ls then writes the associated inode information, in a consistent format, including metadata such as: permissions, number of links, owning user, owning group, file size, modification time and filename to the stdout file descriptor (fd: 1) for the process. All printed metadata is drawn from the inode information that the stat call will return. Finally ls exits and the shell, which has perviously called wait, reprints the shell prompt.