Is it possible to hook a script execution on each process creation?
Essentially the equivalent of inotifywait to monitor disk activity but applied to the process table.
It would be to allow to do an action upon spawning of the processes, for example logging it, cgset it, other. I can see the challenge that it would recursively apply on the new processes. But instead of polling the process table as fast as possible to catch changes which would be vulnerable to race conditions, is there a better way.
Thanks
LD_PRELOAD
ing a customfork
should do the trick for most applications. – Petr Skocik Feb 13 '16 at 21:40fork
syscall directly, and thereby avoid recursion. – Petr Skocik Feb 13 '16 at 22:10fork
system call (orclone
). Most programs invokes c library functions of the same name to get the deed done. Since the c-library is often linked dynamically, you can supply your own custom fork (or clone, or perhaps execve), which in addition to invoking the system call also do the logging you want. – Petr Skocik Feb 13 '16 at 22:42