I wrote an eBPF application that is launched and killed by a PAM session script. It uses the PPID to only record commands and arguments associated with that ses

I wrote an eBPF application that is launched and killed by a PAM session script. It uses the PPID to only record commands and arguments associated with that session. My application was heavily influenced by execsnoop: https://github.com/iovisor/bcc/blob/master/tools/execsnoop.py https://github.com/iovisor/bcc/blob/master/tools/execsnoop.p...