I can do
auditctl -a always,exit -S all -F pid=1234
To log all the system calls done by pid 1234 and:
auditctl -a always,exit -S all -F ppid=1234
For its children, but how do I cover the grand-children and their children as well (current and future)?
I cannot rely on (e)uid/(e)gid that do change.
(note that using
strace is not an option either)