Apport checks if the process was replaced after the crash by comparing between two variables, apport_start and process_start.
process_start gets the start time of the process by parsing the content of /proc/pid/stat file.
The start time is extracted from the 22 column of the /proc/pid/stat file.
def get_starttime(contents): '''Extracts the starttime from the contents of a stat file''' # 22nd field in a stat file is the time the process started after # system boot in clock ticks. return int(contents.split())
We are able to bypass this check by recycle the pid with a process with “ “(space) in its filename, causing process_start to have the wrong value (which is smaller than apport_start).