arch_ptrace...permit_entry(9)

📦 version 7.3.1, in nixpkgs unstable

✨ arch_ptrace...permit_entry ✨

okay bestie, welcome to the Kernel API Manual 💅 this one's a lil' kernel hook page and it's honestly shorter than my attention span, so let's go 🫶

🌸 NAME 🌸

arch_ptrace_report_syscall_permit_entry — the architecture-specific wrapper for ptrace_report_syscall_permit_entry() 🎀

like, it's the "your CPU family gets to have opinions" version of that function, iykyk.

🦋 SYNOPSIS 🦋

bool arch_ptrace_report_syscall_permit_entry (struct pt_regs *regs );

that's it. one function, returns a bool, takes one pointer. she's lowkey minimal 💖

🎀 ARGUMENTS 🎀

  • regs — pointer to the register state at syscall entry. literally the snapshot of where the syscall walked in at 👑

⭐ DESCRIPTION ⭐

so this function gets invoked from syscall_trace_enter, and its whole job is to wrap ptrace_report_syscall_permit_entry ✨

and why, you ask? because it lets each architecture have its own ptrace_report_syscall_permit_entry implementation. main character energy for every arch, no cap 🔥

and if the architecture doesn't define one? no stress 🧚 it just falls back to ptrace_report_syscall_permit_entry. yes, the original says "falls back to to" with the double to and I'm keeping it because I respect the source text 💀 (that's a faithful reproduction, not me being sloppy, fr fr)

🌈 SEE ALSO 🌈

(and yes, enter_from_user_mode_randomize_stack(9) and syscall_enter_from_user_mode_randomize_stack(9) sit next to each other and they're both iconic and both staying 💅 not me almost merging them, absolutely not)

aaaaand that's the whole page, bestie 🦋💖 this gem lives in the source ./include/linux, dated October 2026, and it's filed under arch_ptrace...permit_entry(9) in the kernel docs ✨ go forth and trace those syscalls, you've got this 👑🌸💜

📦 where this page comes from