Hello @cr0nx, first of all, great post, really well explained!

I’ve tested it and it works like a charm on Ubuntu. I’d like to make a small contribution by sharing an improved version of the code that dynamically retrieves the ptrace_scope address using the kaddr function:

#!/usr/bin/env bpftrace

BEGIN
{
    printf("ptrace_scope address: %p\n", kaddr("ptrace_scope"));
    $data_addr = kaddr("ptrace_scope");
    @last_val = *(int32*)$data_addr;  // Initial value
    printf("Monitoring kernel.yama.ptrace_scope at address 0x%x (initial value: %d)\n",
           $data_addr, @last_val);
}

interval:s:1
{
    $data_addr = kaddr("ptrace_scope");
    $current = *(int32*)$data_addr;
    if (@last_val != $current) {
        time("%H:%M:%S ");
        printf("ALERT: kernel.yama.ptrace_scope changed from %d to %d!\n",
               @last_val, $current);
        @last_val = $current;
    }
}

END
{
    clear(@last_val);
    printf("Monitoring stopped\n");
}