ptrace_event_pid(9)

🦋 ptrace_event_pid(9) — Kernel API Manual 🦋

💖 NAME 💖

ptrace_event_pid — the “possibly stop for a ptrace event notification” girlie. Like, it might stop for a ptrace event notification, bestie, that’s the whole vibe.

---

🎀 SYNOPSIS 🎀

okay so the signature is literally this, no cap:

void ptrace_event_pid (int event , struct pid *pid );

---

✨ ARGUMENTS ✨

• event — a PTRACE_EVENT_* value to report. Yes, the PTRACE_EVENT_* family, periodt.
• pid — process identifier for PTRACE_GETEVENTMSG to return. That’s the one.

---

🌸 DESCRIPTION 🌸

So what it does: it checks whether event is enabled, and if it is, it reports event and pid to the ptrace parent. The pid gets reported as the pid_t seen from the ptrace parent’s pid namespace — namespace-flavored, iykyk. 💅

Also, and this is important: called without locks. That’s the note. No locks, bestie. 🫶

---

👑 SEE ALSO 👑

Kernel file: ./include/linux/ptrace.h — plus this whole friend group of manual pages:

• ptrace_may_access(9)
• ptrace_parent(9)
• ptrace_event_enabled(9)
• ptrace_event(9)
• ptrace_init_task(9)
• ptrace_release_task(9)
• arch_has_single_step(9)
• user_enable_single_step(9)
• user_disable_single_step(9)
• arch_has_block_step(9)
• user_enable_block_step(9)
• arch_ptrace_stop_needed(9)
• arch_ptrace_stop(9)
• ptrace_report_syscall_permit_entry(9)
• ptrace_report_syscall_exit(9)

---

Source/version: ./include/linux · date: October 2026. That’s the footer, bestie — mwah 💋✨