01:22:33.663917 execve("/usr/bin/ubuntu-bug", ["ubuntu-bug"], [/* 35 vars */]) = 0 01:22:33.664686 brk(0) = 0x805f000 01:22:33.664872 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) 01:22:33.665076 mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f1c000 01:22:33.665250 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) 01:22:33.665439 open("/etc/ld.so.cache", O_RDONLY) = 3 01:22:33.665606 fstat64(3, {st_mode=S_IFREG|0644, st_size=40489, ...}) = 0 01:22:33.665840 mmap2(NULL, 40489, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7f12000 01:22:33.665989 close(3) = 0 01:22:33.666139 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) 01:22:33.666331 open("/lib/tls/i686/cmov/libc.so.6", O_RDONLY) = 3 01:22:33.666501 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\260a\1"..., 512) = 512 01:22:33.666706 fstat64(3, {st_mode=S_IFREG|0644, st_size=1339816, ...}) = 0 01:22:33.666914 mmap2(NULL, 1349136, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7dc8000 01:22:33.667074 mmap2(0xb7f0c000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x143) = 0xb7f0c000 01:22:33.667258 mmap2(0xb7f0f000, 9744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7f0f000 01:22:33.667415 close(3) = 0 01:22:33.667588 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7dc7000 01:22:33.667751 set_thread_area({entry_number:-1 -> 6, base_addr:0xb7dc76b0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0 01:22:33.676136 mprotect(0xb7f0c000, 4096, PROT_READ) = 0 01:22:33.676262 munmap(0xb7f12000, 40489) = 0 01:22:33.676405 getpid() = 22282 01:22:33.676495 rt_sigaction(SIGCHLD, {SIG_DFL}, {SIG_DFL}, 8) = 0 01:22:33.676613 geteuid32() = 1000 01:22:33.676825 brk(0) = 0x805f000 01:22:33.676910 brk(0x8080000) = 0x8080000 01:22:33.677024 getppid() = 22281 01:22:33.677144 stat64("/home/snifer", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 01:22:33.677302 stat64(".", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 01:22:33.677484 open("/usr/bin/ubuntu-bug", O_RDONLY) = 3 01:22:33.677598 fcntl64(3, F_DUPFD, 10) = 10 01:22:33.677681 close(3) = 0 01:22:33.677761 fcntl64(10, F_SETFD, FD_CLOEXEC) = 0 01:22:33.677846 rt_sigaction(SIGINT, NULL, {SIG_DFL}, 8) = 0 01:22:33.677946 rt_sigaction(SIGINT, {0x80551b0, ~[RTMIN RT_1], 0}, NULL, 8) = 0 01:22:33.678069 rt_sigaction(SIGQUIT, NULL, {SIG_DFL}, 8) = 0 01:22:33.678164 rt_sigaction(SIGQUIT, {SIG_DFL}, NULL, 8) = 0 01:22:33.678256 rt_sigaction(SIGTERM, NULL, {SIG_DFL}, 8) = 0 01:22:33.678351 rt_sigaction(SIGTERM, {SIG_DFL}, NULL, 8) = 0 01:22:33.678450 read(10, "#!/bin/sh -e\n\n# check for X\nif ["..., 8192) = 1105 01:22:33.678727 pipe([3, 4]) = 0 01:22:33.678844 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7dc76f8) = 22283 01:22:33.683275 --- SIGCHLD (Child exited) @ 0 (0) --- 01:22:33.683361 close(4) = 0 01:22:33.683452 read(3, "1000\n", 128) = 5 01:22:33.683545 read(3, "", 128) = 0 01:22:33.683624 close(3) = 0 01:22:33.683720 wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 22283 01:22:33.683839 open("/dev/null", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0666) = 3 01:22:33.683965 fcntl64(1, F_DUPFD, 10) = 11 01:22:33.684044 close(1) = 0 01:22:33.684129 fcntl64(11, F_SETFD, FD_CLOEXEC) = 0 01:22:33.684211 dup2(3, 1) = 1 01:22:33.684289 close(3) = 0 01:22:33.684372 stat64("/usr/local/sbin/pgrep", 0xbf98de8c) = -1 ENOENT (No such file or directory) 01:22:33.684479 stat64("/usr/local/bin/pgrep", 0xbf98de8c) = -1 ENOENT (No such file or directory) 01:22:33.684582 stat64("/usr/sbin/pgrep", 0xbf98de8c) = -1 ENOENT (No such file or directory) 01:22:33.684680 stat64("/usr/bin/pgrep", {st_mode=S_IFREG|0755, st_size=12348, ...}) = 0 01:22:33.684875 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7dc76f8) = 22284 01:22:33.685206 wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 1}], 0, NULL) = 22284 01:22:33.692938 --- SIGCHLD (Child exited) @ 0 (0) --- 01:22:33.693035 dup2(11, 1) = 1 01:22:33.693119 close(11) = 0 01:22:33.693208 pipe([3, 4]) = 0 01:22:33.693308 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7dc76f8) = 22285 01:22:33.695927 close(4) = 0 01:22:33.696026 read(3, "1000\n", 128) = 5 01:22:33.697839 --- SIGCHLD (Child exited) @ 0 (0) --- 01:22:33.697901 read(3, "", 128) = 0 01:22:33.697979 close(3) = 0 01:22:33.698063 wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 22285 01:22:33.698172 open("/dev/null", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0666) = 3 01:22:33.698281 fcntl64(1, F_DUPFD, 10) = 11 01:22:33.698359 close(1) = 0 01:22:33.698436 fcntl64(11, F_SETFD, FD_CLOEXEC) = 0 01:22:33.698512 dup2(3, 1) = 1 01:22:33.698586 close(3) = 0 01:22:33.698667 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7dc76f8) = 22286 01:22:33.698832 wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 1}], 0, NULL) = 22286 01:22:33.704552 --- SIGCHLD (Child exited) @ 0 (0) --- 01:22:33.704633 dup2(11, 1) = 1 01:22:33.704714 close(11) = 0 01:22:33.704811 stat64("/usr/share/apport/apport-gtk", {st_mode=S_IFREG|0755, st_size=9688, ...}) = 0 01:22:33.704978 geteuid32() = 1000 01:22:33.705059 getgid32() = 1000 01:22:33.705133 getegid32() = 1000 01:22:33.705210 getgroups32(0, NULL) = 14 01:22:33.705286 getgroups32(14, [4, 20, 24, 25, 29, 30, 44, 46, 104, 108, 110, 115, 117, 1000]) = 14 01:22:33.705416 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7dc76f8) = 22287 01:22:33.715960 wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 22287 01:22:36.178253 --- SIGCHLD (Child exited) @ 0 (0) --- 01:22:36.178318 read(10, "", 8192) = 0 01:22:36.178372 exit_group(0) = ? Process 22282 detached