PT_TRACE_EXEC 197 include/linux/tracehook.h if (!ptrace_event(PT_TRACE_EXEC, PTRACE_EVENT_EXEC, 0) && PT_TRACE_EXEC 304 kernel/ptrace.c child->ptrace |= PT_TRACE_EXEC;