Re: Detecting process creation/deletion

On Wed, 18 Jan 2006, Kasper Dupont said:
> Ian, Kilgore, > wrote:
>>
>> Hi all. I'm writing a little toy kmod and I need to be able to know
>> whenever a process starts or ends[1]. From my googling I gather there
>> are no special hooks for this, but does anyone know of a (hackish is
>> fine) way to do it?
>> Thanks.
>>
>> [1] Before I get 20 posts saying "don't ever do this it will break your
>> kernel and kill kittens", its not for any actual useful code. I'm just
>> playing around in there =]
>
> Don't try to do this in a module. Instead find the right place
> in the kernel and make your modifications there. Or add the
> hooks.

Can't you use the process events connector to do this? Or is netlink
too unpleasant to use from kernel space?

(Regardless, the process events connector patch makes it pretty
obvious which bits to patch: <http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9f46080c41d5f3f7c00b4e169ba4b0b2865258bf>).

> Adding the hooks will be a bit tricky to do without
> introducing any race conditions, but if you get it right I guess
> people might actually want to use your patch.

I think it's mostly been done :)

--
`Logic and human nature don't seem to mix very well,
unfortunately.' --- Velvet Wood
.