Linux : /proc/<PID>/exe return path to executable '/bin/bash' for process located at '/home/<USER>/new/v'

Question

I am trying to build a script that prints the PID & Path to executable file whenever a new process starts.

My code is as follows:

#include<stdio.h>
#include<stdlib.h>
#include <limits.h>
#include<unistd.h>
#include<fcntl.h>
#include<sys/types.h>
#include<sys/stat.h>
#include<sys/time.h>
#include<string.h>

   void pnotify(){
    int fd,resp,pid,pidbak=0;
    fd_set c;
    struct timeval tv;
    float f;
    char buf[256]="",buf2[256]="";

    fd=open("/proc/loadavg",O_RDONLY,0600);
    if(fd==-1){
        printf("Load error !\n");
        return;
    }

    tv.tv_sec=0;
    tv.tv_usec=10;

    while(1){
        FD_ZERO(&c);
        FD_SET(fd,&c);

        if((resp=select(fd+1,&c,NULL,NULL,&tv))==-1){
            printf("Error select.\n");
            exit(5);
        }
        if(resp>0){
            pidbak=pid;
            read(fd,buf,256);
            lseek(fd,0,SEEK_SET);
            sscanf(buf,"%f %f %f %s %d",&f,&f,&f,buf,&pid);
            memset(buf,0,256);
            if(pid != pidbak){
                sprintf(buf,"/proc/%d/exe",pid);
                if(readlink(buf,buf2,256)<=0){
                    perror("Readlink Error : ");
                    continue;
                }
                printf("PID : %d\tPATH : %s\n",pid,buf2);
            }
            memset(buf,0,256);
            memset(buf2,0,256);
        }
    }   
}

main(){
    pnotify();
}

This code seems to work good in general, However, when i open another new terminal to execute a new process whose executable file is located at /home/<USER>/new/v it provides path at /bin/bash.

Can you please find out whats going wrong?

Answer 1

Nothing is going wrong. 'v' is a shell script, and /bin/bash is the executable process that is actually running. You might be able to get more information out of /proc/$$/cmdline (or comm), depending on what problem you're actually trying to solve. Alternatively, you might use the netlink interface to monitor fork and exec calls.

Note that when a new process starts, it has the same executable as its parent.