From: Fotios Valasiadis <fvalasiad@xxxxxxxxxxx> Fixed incomplete doc. PTRACE_GET_SYSCALL_INFO's description wouldn't inform the user that they need to enable PTRACE_O_TRACESYSGOOD to get detailed information from said operation. Came upon this bug after writing a test program using PTRACE_O_TRACESYSGOOD. After failing to find what's wrong I posted a stackoverflow question which you can find right here: https://stackoverflow.com/questions/72410182/ptrace-get-syscall-info-always-returns-info-op-as-ptrace-syscall-info-none Nate Eldredge found out what's wrong by looking into the kernel's source code, here is a link to the relevant part https://github.com/torvalds/linux/blob/8291eaafed36f575f23951f3ce18407f480e9ecf/kernel/ptrace.c#L1018 In the code it can be seen that the union is filled if and only if the signal matches "SIGTRAP | 0x80", a signal which is only sent if the PTRACE_O_TRACESYSGOOD option is set. You can read about that in the PTRACE_O_TRACESYSGOOD section of ptrace.2 's manual. I am unaware if Nate wants to be included as a co-author of this commit, nor am I aware of any way to contact him. Signed-off-by: Fotios Valasiadis <fvalasiad@xxxxxxxxx> --- man2/ptrace.2 | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/man2/ptrace.2 b/man2/ptrace.2 index 55d9fd36d..b437b4f44 100644 --- a/man2/ptrace.2 +++ b/man2/ptrace.2 @@ -1033,6 +1033,11 @@ If the size of the data to be written by the kernel exceeds the size specified by the .I addr argument, the output data is truncated. +To obtain complete information during system call entry or exit stops, +you should enable the +.B PTRACE_O_TRACESYSGOOD +option using +.B PTRACE_SETOPTIONS. .IP The .I ptrace_syscall_info -- 2.39.2
