In this case, the deliberate killing of the monitor thread provides just as much information to the monitor... e.g. "this guy's hiding something, better scrutinize further!"
Yes, I've seen this before. A friend did some contract work from home for a large company. As part of his contract they lent him a laptop which he had to use to connect to their server and systems. All the time he was logged on a background task logged everything he did.
In this case, the deliberate killing of the monitor thread provides just as much information to the monitor... e.g. "this guy's hiding something, better scrutinize further!"
If this guy is being truthful (I'm still very suspicious), then your strategy is the way to to go about doing this. If I have a security camera in my store because I'm worried my employees are stealing from the drawer, catching her stealing on camera is just as good as catching her putting a sticker over the camera lens (she's fired either way in other words).
The OP should focus his efforts less on circumventing important system functions and more on logging efforts to circumvent his application's monitoring processes.
It took so long because you've been making us guess.
Anyway, as many people have suggested, you *do* want a launchd deamon (aka a service), running in the background, reporting the user's process activity. And, do not provide administrator accounts to the users.
It took so long because you've been making us guess.
Anyway, as many people have suggested, you *do* want a launchd deamon (aka a service), running in the background, reporting the user's process activity. And, do not provide administrator accounts to the users.