How to listen to new forks in kernel

Question

kernel: 3.4+

Does anyone know of any other way beside using kernel process events connector to "listen" to new forks.

I want to be simply notified in my module every time a new task (process) is created.

Answer 1

You could try to use a LSM hook to do this. The function you want to implement is security_task_create

Answer 2

I don't know about the state of SystemTap but I think you can do a function boundary tracing like DTrace on Solaris using SystemTap. You'd need to know which linux kernel function to trace though, but that's the simpler part I presume.