To receive events from the kernel when a file/script is opened for execution with the absolute path of the file (or maybe the working directory, to resolve the absolute path of the file).
I don't want to get events on every file opened.
I have tried listening to the trace point event
sched:sched_process_execand see when the process is an interpreter but the filename is not always shown and when it does it's only the relative path, so there is no way for me to check if the file is from the type i am looking for (script).
I am aware that there is the option to set the FAN_OPEN_EXEC flag with fanotify but that is only for newer kernels (>5.0) and i need something for older kernels as well (also not sure it will work on files, according to the documentation).