ptrace_repor...permit_entry(9)

💅 ptrace_report_syscall_permit_entry — Kernel API Manual energy ✨

okay so bestie, we're in the Kernel API Manual today and this function is literally the bouncer at the door of syscall town 🚪✨

---

🎀 NAME 🎀

ptrace_report_syscall_permit_entry — the task is about to attempt a system call, and we're all up in its business before it happens 👀

---

🦋 SYNOPSIS 🦋

bool ptrace_report_syscall_permit_entry (struct pt_regs *regs );

---

🌸 ARGUMENTS 🌸

• regs — the user register state of the current task. like, the whole vibe of what this task is doing rn 💅

---

⭐ DESCRIPTION ⭐

so here's the tea ☕ this one gets called if SYSCALL_WORK_SYSCALL_TRACE or SYSCALL_WORK_SYSCALL_EMU have been set, at the exact moment the current task has just entered the kernel for a system call. full user register state is available right here, no cap 🙌

and like — changing the values in regs can literally affect the system call number and the arguments that are about to be tried. main character behaviour fr. also it is safe to block here, which prevents the system call from beginning. iconic 🛑

returns True normally, or False if the calling architecture code should abort the system call. and if it returns False, that must prevent normal entry so that no system call is made. periodt.

⚠️ okay heads up bestie: if the task ever returns to user mode after this, its register state is unspecified — but it should be something harmless like an ENOSYS error return. it should also preserve enough information so that syscall_rollback can work (see asm-generic/syscall.h). don't skip that part, it's giving important 🔥

called without locks, just after entering kernel mode 🧚

---

👑 SEE ALSO 👑

kernel file ./include/linux/ptrace.h and also all of these besties:

• ptrace_may_access(9)
• ptrace_parent(9)
• ptrace_event_enabled(9)
• ptrace_event(9)
• ptrace_event_pid(9)
• ptrace_init_task(9)
• ptrace_release_task(9)
• arch_has_single_step(9)
• user_enable_single_step(9)
• user_disable_single_step(9)
• arch_has_block_step(9)
• user_enable_block_step(9)
• arch_ptrace_stop_needed(9)
• arch_ptrace_stop(9)
• ptrace_report_syscall_exit(9)

---

🫶 mwah, that's the whole page! this lil beauty lives over in ./include/linux and it's dated October 2026 — go off, kernel docs, we love to see it 💖✨🎀