Install — proc-trace-exec

Requirements

Linux only. proc-trace-exec uses the kernel's netlink proc connector — a Linux-specific interface. It does not run on macOS or Windows.

Requirement	Notes
Linux kernel	Any modern distro kernel (CONFIG_CONNECTOR=y is standard)
CAP_NET_ADMIN	Required to subscribe to the netlink proc socket. `sudo` works.
x86-64 or arm64	Pre-built binaries provided for both. Build from source for others.

Pre-built Binary

Download & Run

Fully static binaries — no libc, no runtime dependencies. Download, mark executable, run with sudo.

Linux — amd64 (x86-64)

$ curl -fsSL https://github.com/binRick/proc-trace-exec/releases/latest/download/proc-trace-exec-linux-amd64 -o proc-trace-exec
$ chmod +x proc-trace-exec
$ sudo mv proc-trace-exec /usr/local/bin/
$ sudo proc-trace-exec --help

Linux — arm64 (Raspberry Pi, AWS Graviton, etc.)

$ curl -fsSL https://github.com/binRick/proc-trace-exec/releases/latest/download/proc-trace-exec-linux-arm64 -o proc-trace-exec
$ chmod +x proc-trace-exec
$ sudo mv proc-trace-exec /usr/local/bin/

Tip: verify the binary works before moving it — ./proc-trace-exec --help does not require root and exits immediately.

quick test

$ sudo proc-trace-exec -t bash -c "echo hello"
12345+ bash
  12346+ echo
  12346- echo exited status=0
12345- bash exited status=0

RPM Package

RHEL 9 / AlmaLinux 9 / Rocky Linux 9

Built natively inside an AlmaLinux 9 container via GitHub Actions. Compatible with any RHEL9-based distro.

rpm install

# download the latest RPM from GitHub releases
$ curl -fsSL -O https://github.com/binRick/proc-trace-exec/releases/latest/download/proc-trace-exec-0.1.0-1.el9.x86_64.rpm

# install
$ sudo rpm -ivh proc-trace-exec-*.rpm

# or with dnf
$ sudo dnf localinstall proc-trace-exec-*.rpm

# verify
$ which proc-trace-exec
/usr/local/bin/proc-trace-exec

Find the exact RPM filename on the Releases page →

Build from Source

Go 1.22+ required

Produces a native binary for your current platform. Zero external dependencies — the Go standard library is all that's needed.

build from source

$ git clone https://github.com/binRick/proc-trace-exec
$ cd proc-trace-exec
$ go build -trimpath -ldflags="-s -w" -o proc-trace-exec .
$ sudo mv proc-trace-exec /usr/local/bin/

No Docker? The build.sh script builds a fully static binary using a Docker golang:1.22-alpine image — no local Go toolchain required. See Building → for details.

📦 Install

Download & Run

RHEL 9 / AlmaLinux 9 / Rocky Linux 9

Go 1.22+ required