cap_ptrace_traceme(9)

✨ NAME ✨

cap_ptrace_traceme(9) — determine whether another process may trace the current 🫶 Welcome to the cap_ptrace_traceme(9) page from the Kernel API Manual, bestie — this one's short but lowkey important 💅

✨ SYNOPSIS ✨

int cap_ptrace_traceme (struct task_struct *parent );

🎀 ARGUMENTS 🎀

• parent — the task proposed to be the tracer. That's the candidate we're vibe-checking to see if it gets to trace the current process 👀

💅 DESCRIPTION 💅

Okay so here's the tea: if parent is in the same or an ancestor user_ns and has all of current's capabilities, then ptrace access is allowed, periodt ✨

If parent has the ptrace capability to current's user_ns, then ptrace access is allowed too. Else? Denied. No cap, no entry 🚫

So basically we're determining whether the nominated task is permitted to trace the current process. The return value is 0 if permission is granted, and -ve if it's denied. That's it, that's the whole plot 😭

🌈 SEE ALSO 🌈

Kernel file ./security/commoncap.c, plus the whole iconic crew:

• cap_capable_helper(9)
• cap_capable(9)
• cap_settime(9)
• cap_ptrace_access_check(9)
• cap_capget(9)
• cap_capset(9)
• cap_inode_need_killpriv(9)
• cap_inode_killpriv(9)
• kuid_root_in_ns(9)
• rootid_from_xattr(9)
• cap_convert_nscap(9)
• get_vfs_caps_from_disk(9)
• cap_bprm_creds_from_file(9)
• cap_inode_setxattr(9)
• cap_inode_removexattr(9)
• cap_task_fix_setuid(9)
• cap_task_setscheduler(9)
• cap_task_setioprio(9)
• cap_task_setnice(9)
• cap_task_prctl(9)
• cap_vm_enough_memory(9)
• cap_mmap_addr(9)

That's the whole page, bestie 💖 this came from ./security and is dated October 2026 — it's the cap_ptrace_traceme(9) manual, so go trace responsibly, or like, don't, unless the cap check says yes 💅🦋