ptracer_access_allowed(9)

💖 ptracer_access_allowed(9) 💖

okay so bestie, welcome to the Kernel API Manual entry for ptracer_access_allowed(9) — yes, the whole page is just about whether current may peek/poke @tsk's address space. iconic question, honestly.

✨ NAME ✨

ptracer_access_allowed — may current peek/poke @tsk's address space?

🎀 SYNOPSIS 🎀

bool ptracer_access_allowed (struct task_struct *tsk );

🦋 ARGUMENTS 🦋

• tsk — tracee. that's the task being traced, bestie 🫶

💅 DESCRIPTION 💅

okay so this is the per-access check used by ptrace_access_vm and the architecture-specific tag/register accessors. she returns true iff current is the registered ptracer of tsk and either tsk is owner-dumpable or current holds CAP_SYS_PTRACE in tsk's exec namespace. no cap.

lowkey she's lighter than __ptrace_may_access: on every access she re-validates only dumpability and capability, and does not re-run the LSM hooks or cred_cap_issubset checks that were performed at attach time. the way that's a whole different vibe from attach-time checking 💅 periodt.

🔥 SEE ALSO 🔥

• Kernel file ./kernel/ptrace.c — __ptrace_unlink(9), ptrace_check_attach(9), ptrace_traceme(9)

mwah 💋 source/version: ./kernel · date: October 2026 · that's the cute little footer sign-off, bestie 🫶