Forget bpf, Linux has the audit framework to solve exactly this problem, and it's been in heavy use for a couple of decades now https://www.redhat.com/en/blog/

Forget bpf, Linux has the audit framework to solve exactly this problem, and it's been in heavy use for a couple of decades now https://www.redhat.com/en/blog/configure-linux-auditing-auditd https://www.redhat.com/en/blog/configure-linux-auditing-audi... https://linux-audit.com/linux-audit-framework/configuring-and-auditing-linux-systems-with-audit-daemon/ https://linux-audit.com/linux-audit-framework/configuring-an...