#define PTRACE_SYSCALL_PIPE 1 long ptrace(long request, pid_t pid, void *addr, void *data);
This syscall can be used for tracing, debugging, execution control, and info
reporting of data owned by a child process. The operations is indicated by
request, while the PID to act upon is pid, addr the
address in the child process to modify, and data what to modify with.
request can be one of:
PTRACE_SYSCALL_PIPE (1): data will be taken as an FD in the
child process, which the kernel will use to report the state on every syscall
the child process does. The descriptor must be a pipe, no other files are
supported. Errors writing are silently ignored.
The syscall returns 0 or -1 on failure, with the following errno:
EACCES: MAC did not allow this.
EPERM: pid is not a child or does not exist.
EINVAL: request is not valid.