aa_may_ptrace(9)

💅 aa_may_ptrace(9) — like, the whole kernel API manual, bestie

okay so real talk: this is aa_may_ptrace, and it lives in the Kernel API Manual. It's the vibe check that answers one very specific question — can this tracer task actually trace that tracee? 🕵️‍♀️✨

---

🌸 SYNOPSIS 🌸

int aa_may_ptrace (const struct cred *tracer_cred , struct aa_label
*tracer , const struct cred *tracee_cred , struct aa_label *tracee , u32
request );

like yes, it's a long signature, but it's giving thorough 👑 — five arguments, one int back.

---

🎀 ARGUMENTS 🎀

• tracer_cred — the cred of the task doing the tracing. 🫶 and it's stamped NOT NULL, so do not come in here with a null, bestie, I'm begging.
• tracer — the label of the task doing the tracing. also NOT NULL. no cap, both of the tracer-side ones are mandatory. 💅
• tracee_cred — the cred of the task that's getting traced.
• tracee — the task label that's getting traced.
• request — the permission request. it's a u32, and it's exactly what it says on the tin.

ngl the tracee-side params don't carry the NOT NULL note — only tracer_cred and tracer do. just saying. 👀

---

⭐ RETURN ⭐

You get 0, or else an error code if permission denied or error. that's the whole thing. zero means slay, anything else means the door stayed shut. 🚪💀

---

🦋 SEE ALSO 🦋

Kernel file ./security/apparmor/task.c, plus the whole little friend group:

• aa_get_task_label(9)
• aa_replace_current_label(9)
• aa_set_current_onexec(9)
• aa_set_current_hat(9)
• aa_restore_previous_label(9)
• audit_ptrace_mask(9)

---

okay that's the page!! 💖 it ships from ./security/apparmor, dated October 2026, tagged with version aa_may_ptrace(9) — mwah, go trace something responsibly 🧚‍♀️🌈✨