09a56a98b7
Kernel has few information about which isolated process belongs to which application, so there is actually no good choice if we don't implement a userspace daemon. One choice is to access cmdline memory from kernel, but cmdline is __user, and it is likely to trigger detections. Before we have more good ideas, use this.