The most problematic user of "->ptrace & PT_" checks is tracehook_prepare_clone().
I need to re-check this, but iirc this hook is not needed at all since "[PATCH 10] ptrace_report_clone: rework auto-attaching". This patch changes it to always return 0. --- include/linux/tracehook.h | 12 ------------ 1 file changed, 12 deletions(-) --- PU/include/linux/tracehook.h~19_DISABLE_PREPARE_CLONE 2009-08-20 20:09:25.000000000 +0200 +++ PU/include/linux/tracehook.h 2009-09-02 20:30:00.000000000 +0200 @@ -208,18 +208,6 @@ static inline void tracehook_report_exit */ static inline int tracehook_prepare_clone(unsigned clone_flags) { - if (clone_flags & CLONE_UNTRACED) - return 0; - - if (clone_flags & CLONE_VFORK) { - if (current->ptrace & PT_TRACE_VFORK) - return PTRACE_EVENT_VFORK; - } else if ((clone_flags & CSIGNAL) != SIGCHLD) { - if (current->ptrace & PT_TRACE_CLONE) - return PTRACE_EVENT_CLONE; - } else if (current->ptrace & PT_TRACE_FORK) - return PTRACE_EVENT_FORK; - return 0; }