ptrace_may_access(9)

💅 ptrace_may_access — Kernel API Manual energy 💅

okay so bestie, welcome to ptrace_may_access(9). This is the Kernel API Manual moment where we check whether the caller is even permitted to access a target task. It’s giving permissions vibe check, and honestly? iconic. 🫶

🌸 NAME 🌸

ptrace_may_access — check whether the caller is permitted to access a target task.

🎀 SYNOPSIS 🎀

bool ptrace_may_access (struct task_struct *task , unsigned int mode );

🦋 ARGUMENTS 🦋

• task — the target task. The one getting the access check. 👀
• mode — selects the type of access and the caller credentials. It’s the little settings bag for this whole operation. ✨

🔥 DESCRIPTION 🔥

Returns true on success, false on denial. That’s the whole result arc, no cap.

One of the flags PTRACE_MODE_FSCREDS and PTRACE_MODE_REALCREDS must be set in mode to specify whether the access was requested through a filesystem syscall (should use effective capabilities and fsuid of the caller) or through an explicit syscall such as process_vm_writev or ptrace (and should use the real credentials). So yeah, mode has to carry one of those flags — it’s not optional, bestie. 💅

🌈 SEE ALSO 🌈

Kernel file: ./include/linux/ptrace.h

• ptrace_parent(9)
• ptrace_event_enabled(9)
• ptrace_event(9)
• ptrace_event_pid(9)
• ptrace_init_task(9)
• ptrace_release_task(9)
• arch_has_single_step(9)
• user_enable_single_step(9)
• user_disable_single_step(9)
• arch_has_block_step(9)
• user_enable_block_step(9)
• arch_ptrace_stop_needed(9)
• arch_ptrace_stop(9)
• ptrace_report_syscall_permit_entry(9)
• ptrace_report_syscall_exit(9)

source/version: ./include/linux ✨ date: October 2026 ✨ page title: ptrace_may_access(9) — bye bestie, go check those permissions responsibly 💖🦋