> I saw the `sleep 100` process as direct child of `sshd`.
Keep in mind that shells like Bash do an implicit 'exec' in case the end of the script is detected, no traps are set, etc. etc. etc.
> How do you determine this?
$ ssh floeper echo foo '&&' echo bar
foo
bar
Notice how this should have printed "foo && echo bar" if this was passed to execve() directly.
> Also, in the man page for ssh it says:
> > If a command is specified, it is executed on the remote host instead of a login shell.
> which sounds to me like a shell is not involved in this case.
The emphasis on that sentence from the man page should be on login shell. SSH always spawns a shell, regardless of whether a command is provided or not. It's just that it's not a login shell if a command is given. Your shellrc file won't be run.
Also, in the man page for ssh it says:
> If a command is specified, it is executed on the remote host instead of a login shell.
which sounds to me like a shell is not involved in this case.