PTRACE_SYSCALL isn't what you want, since it will always run the syscall. What you can do is use PTRACE_SYSEMU, which allows you to emulate a syscall in userlan

PTRACE_SYSCALL isn't what you want, since it will always run the syscall. What you can do is use PTRACE_SYSEMU, which allows you to emulate a syscall in userland. It will break on syscall enter, allow you to emulate your syscall (e.g. with your scheme of "run it without root, ask user for elevated privs if necessary"), and resume execution at the next instruction when you ptrace again, never really executing the syscall instruction. For this to work you'd also need a way to share various namespaces (like file descriptors) which is doable via the clone2 syscall. There's a ton of cool tricks you can do with linux, it's a really powerful kernel.