# Linux Kernel Module Cheat

#### 17.13.1. CONFIG_PROC_EVENTS

Logs proc events such as process creation to a netlink socket.

We then have a userland program that listens to the events and prints them out:

    # ./linux/proc_events.out &
    # set mcast listen ok
    # sleep 2 & sleep 1
    fork: parent tid=48 pid=48 -> child tid=79 pid=79
    fork: parent tid=48 pid=48 -> child tid=80 pid=80
    exec: tid=80 pid=80
    exec: tid=79 pid=79
    # exit: tid=80 pid=80 exit_code=0
    exit: tid=79 pid=79 exit_code=0
    echo a
    a
    #

Source: userland/linux/proc_events.c

TODO: why `exit: tid=79` shows after `exit: tid=80`?

Note how `echo a` is a Bash built-in, and therefore does not spawn a new process.

TODO: why does this produce no output?

    ./linux/proc_events.out >f &

- https://stackoverflow.com/questions/6075013/detect-launching-of-programs-on-linux-platform/8255487#8255487

- https://serverfault.com/questions/199654/does-anyone-know-a-simple-way-to-monitor-root-process-spawn

- https://unix.stackexchange.com/questions/260162/how-to-track-newly-created-processes

TODO can you get process data such as UID and process arguments? It seems not since `exec_proc_event` contains so little data: https://github.com/torvalds/linux/blob/v4.16/include/uapi/linux/cn_proc.h#L80 We could try to immediately read it from `/proc`, but there is a risk that the process finished and another one took its PID, so it wouldn’t be reliable.

- https://unix.stackexchange.com/questions/163681/print-pids-and-names-of-processes-as-they-are-created/163689 requests process name

- https://serverfault.com/questions/199654/does-anyone-know-a-simple-way-to-monitor-root-process-spawn requests UID

- CONFIG_PROC_EVENTS aarch64