How to listen to new plugs in the core

Question

Kernel: 3.4+

Does anyone know of another way to use the kernel process event connector to “listen” for new forks.

I want to be simply notified in the module every time a new task (process) is created.

Answer 1

You can try using LSM hook to do this. The function you want to implement is security_task_create

Answer 2

I do not know about the state of SystemTap, but I think that you can trace the border of a function, for example, DTrace on Solaris, using SystemTap. You will need to know what function of the Linux kernel can be traced, but this is the simpler part that I assume.

Answer 3

There are several possible hacks that you could use to solve this problem.

You can connect the corresponding table in the syscall table, replace sys_fork with your code, and call the original sys_fork.

Otherwise, you can enable sys_fork.