Does this use eBPF? Can it be expanded to work with other syscalls besides exec? I find myself using not only execsnoop.bt but also opensnoop.bt, statsnoop.bt, tcpconnect.bt etc.
tracexec uses BPF to some extent, but probably not in the way you guessed. it uses ptrace to do most of the work and use seccomp-bpf to speed it up. Using eBPF to do the syscall filtering requires root, so that's a reason for me to choose ptrace. And credits to the strace developers: https://pchaigno.github.io/strace/2019/10/02/introducing-str...