You suspect that the /usr/bin/ps binary has been replaced. What command is used to check against the package installation information to check if the file has changed?