ptrace_check_attach(9)

💅 ptrace_check_attach(9) — like, the Kernel API Manual page, bestie ✨

okay so real talk, this is a page from the Kernel API Manual and it's about ptrace_check_attach, which is basically the vibe check you run before you do anything ptrace-y to a task. let's get into it 🫶

---

🌸 NAME 🌸

ptrace_check_attach — checks whether a ptracee is, like, ready for a ptrace operation 👑

✨ SYNOPSIS ✨

int ptrace_check_attach (struct task_struct *child , bool ignore_state
);

🎀 ARGUMENTS 🎀

• child — the ptracee you're checking on 🧚 this is the one getting the vibe check.
• ignore_state — lowkey the "do I care about the state rn" switch. telling this true means don't check whether child is currently TASK_TRACED.

💖 DESCRIPTION 💖

so the whole point: this checks whether child is being ptraced by current (yes, you 👈) and is ready for further ptrace operations. it's giving "are we allowed to keep going here" energy.

now, the ignore_state thing matters, so pay attention bestie:

• if ignore_state is false, then child also has to be in TASK_TRACED state — and on return, child is guaranteed to be traced and not executing. like, fr fr, guaranteed. no cap. 🔥
• if ignore_state is true, then child can be in any state. any. whatever it's going through, we accept it. 💀

🦋 CONTEXT 🦋

heads up on the locking: it grabs and releases tasklist_lock and child->sighand->siglock. so yeah, it's doing lock stuff behind the scenes — main character energy but with mutexes. 🔒

🌈 RETURN 🌈

• 0 on success 🎉 slay.
• -ESRCH if child is not ready 😭 sorry bestie.

⭐ SEE ALSO ⭐

• Kernel file ./kernel/ptrace.c
• ptracer_access_allowed(9)
• __ptrace_unlink(9)
• ptrace_traceme(9)

go read those too, iykyk 💜

---

mwah 💋 this lil gem lives under ./kernel, dated October 2026, and it's literally called ptrace_check_attach(9) — that's the whole sign-off, periodt. 🎀✨