Preventing program execution in Linux?

Question

linux

It is necessary to write some software for Linux that would monitor the launch of executable files by the user, check these executable files according to some criterion (it doesn’t matter) and either allow their execution or block the launch and notify the user. In this connection, the question arises - how is this implemented in Linux and where to start digging?

Answer 1

You can write so-shku and in LD_PRELOAD it, but it's easy to bypass (well, if you know about it).
It is possible for a kernel module to intercept the exec() call, but this is difficult to implement.

Answer 2

By the way, I met a crutch that parsed the output of top and nailed unwanted ones.

Answer 3

apparmor, did not look at selinux profiles?