CODEWITHSUNDEEP
unixoperating-systemmonitoring
cerisier
cerisier

Reputation: 1201

How to monitor execution of new root process?

I want to exec a script when a new root process starts (on Linux). How can I simply do that ?

Upvotes: 1

Views: 271

Answers (2)

Shnatsel
Shnatsel

Reputation: 4209

This answer explains how to get notified about creation of new processes and will tell you process IDs.

Given the process ID you can trivially determine whether the process belongs to UID 0, i.e. user root.

Upvotes: 0

smilingthax
smilingthax

Reputation: 5734

I guess this will be tricky, as the script would probably also be spawned as root -- and then even every external command in it.

But I think it is possible with SystemTap.

Upvotes: 1

Related Questions