1. 5
  1.  

  2. 2

    There are also a couple of other ways that one can monitor for process completion using notifications, but they were not appropriate for the ifupdown-ng design.

    Notifications for process completion seem like a better design if the goal is to detect the event as quickly as possible. You can use the process event connector from Linux 2.6 [1].

    I once had an idea to make a process that could listen for all shells that launch/exit, then strace them and look at everything they read/write and log it. I called it duckhunter [2] (why? I don’t remember). It’s easy to listen to the socket using BPF [3]. You can definitely only listen to process exits, but I no longer remember what other filtering you can do in the kernel before the userland process gets the message.

    [1] https://lwn.net/Articles/157150/

    [2] https://github.com/asimihsan/duckhunter

    [3] https://github.com/asimihsan/duckhunter/blob/master/src/connector.c