// C includes #include #include #include #include // Libraries we wrote #include "readlines/readlines.h" #include "getoutput_demo/getoutput.h" // C++ includes #include using namespace std; char debug_mode = 0; map reported_users; void child(){ int logfile_fd; if(!debug_mode){ chdir(getenv("HOME")); logfile_fd = open("process_messages", O_WRONLY | O_CREAT | O_TRUNC, 0644); if(logfile_fd < 0){ perror("open"); return; } close(0); close(1); close(2); dup2(logfile_fd, 1); dup2(logfile_fd, 2); } chdir("/"); // Wikipedia points out a lot of daemons do this while(1){ sleep(1); system("ps axu | cut -d \" \" -f 1 | grep -v root | sort -u > /tmp/usernames"); for(const auto &l : readlines("/tmp/usernames")){ char *string_process_count = getoutput( ("ps axu | grep " + l + " | wc -l").c_str() ); if(!string_process_count){ perror("getoutput"); return; } int process_count = atoi(string_process_count); free(string_process_count); if(process_count >= 100) { // Did we already report this? if(reported_users.contains(l)){ if(reported_users[l] == process_count) continue; } reported_users[l] = process_count; dprintf(1, "User %s has %d or more processes\n", l.c_str(), process_count); } } } // Won't run anyway close(logfile_fd); } int main(int argc, char ** argv){ if(argc > 1 && !strcmp(argv[1], "--debug")) debug_mode = 1; if(debug_mode) child(); else { pid_t pid = fork(); if(pid) { // parent process return 0; } else { // child process child(); } } }