I ran an eBPF program called opensnoop [1] to capture what files were opened during login to a system and then re-launching bash. Looks like both are read durin

I ran an eBPF program called opensnoop [1] to capture what files were opened during login to a system and then re-launching bash. Looks like both are read during initial login but only .bashrc for non-login shells. Output is below. 24435 bash 3 0 /etc/profile 24435 bash 3 0 /etc/profile.d/ 24435 bash 3 0 /etc/profile.d/256term.sh 24435 bash 3 0 /etc/profile.d/colorgrep.sh 24435 bash 3 0 /etc/profile.d/colorls.sh 24435 bash 3 0 /etc/profile.d/lang.sh 24435 bash 3 0 /etc/profile.d/less.sh 24435 bash 3 0 /etc/profile.d/which2.sh 24435 bash 3 0 /etc/profile.d/sh.local 24435 bash 3 0 /home/centos/.bash_profile 24435 bash 3 0 /home/centos/.bashrc 24435 bash 3 0 /etc/bashrc 24736 bash 3 0 /home/centos/.bashrc 24736 bash 3 0 /etc/bashrc 24736 bash 3 0 /etc/profile.d/ 24736 bash 3 0 /etc/profile.d/256term.sh 24736 bash 3 0 /etc/profile.d/colorgrep.sh 24736 bash 3 0 /etc/profile.d/colorls.sh 24736 bash 3 0 /etc/profile.d/lang.sh 24736 bash 3 0 /etc/profile.d/less.sh 24736 bash 3 0 /etc/profile.d/which2.sh [1] http://www.brendangregg.com/blog/2014-07-25/opensnoop-for-linux.html http://www.brendangregg.com/blog/2014-07-25/opensnoop-for-li...