Why is the name of a process in /proc/PID/status not matching package name or ps command

Question

A native application I wrote uses /proc/PID/status name variable. However, it appears that the name variable in the status file is incomplete. For example, when testing I opened the Android calculator and looked up the PID from PS and went to the corresponding /proc/PID folder. Then I cat the status file to see

Name: oid.calculator

The PS command shows com.android.calculator. packages.xml shows com.android.calculator. I tested on a few other phones (Razr Maxx running 4.0.4, Google Nexus running the same OS version) and noticed similar behavior.

Answer 1

This is down to a Linux kernel feature: there are two different names for a process.

• One of the names is the last component of the path to the executable, e.g. native_executable if your application is located at /data/apps/com.example.hello/native_executable. This is the name that appears in the Name field of /proc/PID/status. The kernel truncates it to 15 characters, so in this case it contains native_executab.
• The other name is passed by the program that calls the application as its command line parameter #0 (argv[0] in C, args[0] in Java). This is the name that appears at the beginning of /proc/PID/cmdline and that ps shows.
• The path to the executable is also the target of the symbolic link /proc/PID/exe.

By convention, when a program starts another, it should use the name of the executable file as command line parameter 0, but it may choose to do otherwise. The Name field of /proc/PID/status is always set to the (truncated) name of the executable by the kernel.

This is a general Linux feature — see also Can I use standard tools to get the full name of a process, when its name has embedded spaces? on Ask Ubuntu.

The application itself can change both names afterwards (albeit there are length constraints). Dalvik uses this capability to distinguish between applications: all applications stem from the same native executable /sytem/bin/app_process; rather than let them all be called app_process, the VM changes both names to be the application package name. The name in /proc/PID/status is limited to 15 characters, which is why it's truncated. You can get the longer name from /proc/PID/cmdline (read up to the first null byte).