Listening to new processes in the Linux kernel module

Question

Is it possible to receive a notification (via a callback or the like) when a new process is running, when it is closed, and when the state changes (i.e., stopped, unloaded, etc.)? In the user zone, it would be easy to configure a directory listener on / proc.

Answer 1

Have you considered kprobes? You can use kprobes to execute a callback function when executing some kernel code. For example, you can add do_fork kprobe to notify you of new processes in this example .

Similarly, you can add a probe for do_exit() to catch when the processes are complete.

To change the state, you can have a return sensor on sched_switch() and catch when the state changes. Depending on your application, this may add too much overhead.

If you only want to collect data, do some light processing and don’t want to do more with the kernel module, systemtap can be a good alternative to writing a kernel module: https://sourceware.org/systemtap/documentation.html

More on kprobes: https://www.kernel.org/doc/Documentation/kprobes.txt

sched_switch() Example system: https://sourceware.org/systemtap/examples/profiling/sched_switch.stp