I want to exec a script when a new root process spawns. (on Linux) How can I simply do that ?
This sounds like a perfect job for auditd. Once you have auditd running, a default service on modern RedHat based systems, you can craft a rule that will do exactly what you want by executing
Breaking this command rule down, making excessive use of the man page, we find that:
So always write out a record for this action whenever a fork or clone system call exits.
The final option can be thought of as a filter string, in our use
Note that this rule can be executed at run time by making sure that auditd is properly configured, and adding the rule
Just keep in mind that this will be pretty dang noisy, and whomever is doing your log reviews will need to be prepared for it.
I don't think there's a clean way to do this without recompiling your kernel with CONFIG_PROC_EVENTS and/or CONFIG_KPROBES (although I'd love to know if there is a way of doing it, so I've upvoted your question).
I did have an idea of using iwatch/inotify for directory creation inside /proc but it didn't seem to work, neither did auditctl. It looks like your best choice, although dirty, is to continually parse ps for a change from a script. The following Perl code would do it, although would be prone to miss some and ignores
The best way I can think of would be to build off the snoopy library. snoopy is a very small shared library that gets hooked into
A few things to note: