check if a program was used/accessed

hey y'all. I want to be able to check if a program was used on my computer without going through my logs. Lets say if i go to the store and leave my laptop on with no password. Just go with it. Im running a live CD and sometimes an easy solution is not as fun as a project! So as I was saying; If I go to the store, can I write a program in C that does x if a program like firefox is opened? Like shut down or reboot? The execve function comes to mind, if that would even work. So how can i go about doing this?

I'm not sure, but you could try either:
a) monitoring the active processes of the system and then checking if one of the PIDs correspond to the application you want
b) polling a logfile and scanning for the string that matches the launch of the application you want

Sounds like a tedious task! For option a, doesn't the pid of a program change every time you open and close it? Option b sounds like it would 2 heavy on my system!

Yes, and that's why the sysctl() command will tell you the name of the process as long as the ID. Use the call, sort through the data it returns, and then find if one of them is the application you want.

And yeah, option 2 is easier but takes more system resources.

Ok I'm going to have a crack at it. Thanks memcpy.

If you're having trouble with the PID thing, this might help you get started:

Code:

---

#include <sys/param.h>
#include <sys/user.h>
#include <sys/sysctl.h>

        struct kinfo_proc *procs = NULL;
        int i, rt;
        size_t size = 0;
       
        int mib[] = {CTL_KERN, KERN_PROC, KERN_PROC_ALL, 0};
       
        rt = sysctl(mib, 3, NULL, &size, NULL, 0);


        procs = realloc(procs, size);
       
        rt = sysctl(mib, 3, procs, &size, NULL, 0);
       
        for (i = 0; i < (size / sizeof(struct kinfo_proc)); i++)
                printf("%d  %s\n", procs[i].kp_proc.p_pid, procs[i].kp_proc.p_comm);
       
        free(procs);

---

All dynamically linked programs are launched via the dynamic linker ld-linux.so, so if you modify ld-linux.so with your own watchdog code and install it as the system dynamic linker, all programs will be intercepted at that point.

Statically linked programs would be immune, but most programs aren't statically linked.

brewbuck, i am going to google everything. Im starting from ground up because this is all new to me. I have never heard of the dynamic linker ld-linux.so I hope to learn a great deal from this!

So how would i modify the ld-linux.so file?

BTW Memcpy, that code snippet you posted is BSD specific.

Question for ever can answer. I am trying to find a way to implement the sysctl call for linux, specifically Ubuntu. What are the management information base arguments? KERN_PROC, KERN_PROC_ALL, are used for FreeBSD. Any info on the subject will be helpful thanks.