views:

46

answers:

2

Hello Everyone!

Any help with this problem would be fantastic. I appreciate all contributions!

Let us say I'm running a daemon that is observing the behaviour of the app that has keyboard focus. I have it's PID and process name. Is there any way I can see what files that application is accessing?

I'm programming in Objective-C, Cocoa and C.

Thanks!

EDIT:

Sorry, I should have clarified. I want to be doing this programmatically from the daemon. Thanks

+2  A: 

There's a command line tool called lsof that shows you every file that's open and what program has it open. You could look at its source, then do the same thing periodically.

I don't think you can intercept reads and writes, though—not without using DTrace, which requires root powers.

Peter Hosey
`strace` doesn't require `root` permissions and shows all file access
qrdl
qrdl: That appears to require Linux.
Peter Hosey
A: 

Use the Activity Monitor (from /Applications/Utilities).

Pick your process - press the Inspect button.

Choose the Open Files and Ports tab.

Jonathan Leffler
Thanks! but that's not exactly what I was looking for. Check my edit.
Eric Brotto
OK - clearly, the answer is "Yes" because the Activity Monitor (and `lsof`) do it. It is not as easy, though. Have fun!
Jonathan Leffler
Right. I guess what you are saying, in an indirect way, is find the source code of the Activity Monitor and go from there. Sorry if I misunderstood :)
Eric Brotto
@Eric: more particularly, I was saying I'm not sure exactly how to do it. However, the information can be retrieved - possibly only by suitably privileged programs (programs with root privileges).
Jonathan Leffler