I am trying to write kext for Mac OS X which will get notified when any process is started.
In Windows you can do this by calling PsSetLoadImageNotifyRoutine(...) and specify callback which will be called when the process is starting. This is documented way and it works in all Windows starting from Win 2k.
Is there anything similar for Mac? It seems like this is possible to achieve using kauth process listeners, but process scope has never been implemented in OS X.
Another alternative is to hook SYS_execve and friends, but this is undocumented and unsupported way. I really don't want to go this way.
I don't need any cancelling - just want to be notified when process is started, and get it's pid & path.</div