ptrace_parent(9)

💜 ptrace_parent(9) — a Kernel API Manual moment 💜

okay bestie, buckle up, because we're diving into <pink>ptrace_parent(9)</pink> from the Kernel API Manual (yes, section 9, the ~spicy~ one) and honestly? it's a tiny page but it matters.

---

✨ NAME ✨

ptrace_parent — returns the task that's tracing the task you handed it 🕵️‍♀️💅

✨ SYNOPSIS ✨

struct task_struct * ptrace_parent (struct task_struct *task );

literally the whole signature. that's it. that's the vibe. 🎀

✨ ARGUMENTS ✨

• task — the task you're considering 👀 like, the one you wanna know the tracer of

✨ DESCRIPTION ✨

so here's the tea 🍓: it returns NULL if nobody is tracing task, or — if someone is — you get back the struct task_struct pointer to its tracer. main character energy, but the tracer is the main character. 👑

⚠️ okay this part is important, don't skip it: this must be called under rcu_read_lock. no cap. and the pointer you get back might be kept live only by RCU — so don't go wild with it, bestie, it's on RCU's good graces. 😭

also, during exec, this may be called with task_lock held on task — still held from when check_unsafe_exec was called. so like, that lock is just... still there. hanging out. 🫶

✨ SEE ALSO ✨

check the kernel file ./include/linux/ptrace.h for the whole friend group 💖 — it's giving ptrace family reunion:

• ptrace_may_access(9)
• ptrace_event_enabled(9)
• ptrace_event(9)
• ptrace_event_pid(9)
• ptrace_init_task(9)
• ptrace_release_task(9)
• arch_has_single_step(9)
• user_enable_single_step(9)
• user_disable_single_step(9)
• arch_has_block_step(9)
• user_enable_block_step(9)
• arch_ptrace_stop_needed(9)
• arch_ptrace_stop(9)
• ptrace_report_syscall_permit_entry(9)
• ptrace_report_syscall_exit(9)

like, fifteen(ish) besties, all iconic, all in one header. iykyk 🌈

---

and that's the whole page, bestie — go forth and trace responsibly 🦋

🎀 sign-off time: this little gem lives in ./include/linux and the version/date on it is October 2026. keep that in your notes. mwah 💋 🌸 that's a wrap! stay safe, hold your RCU read lock, and remember: the tracer is out there. probably. 💜