> My gut feeling this code needs ptrace_may_access() checks.
That would be fine with me. The nodes are readable only by user, which seems sufficient to me. But I certainly don't object to the stronger check there. I didn't put too much thought into /proc/pid/syscall, it's just there to demonstrate and test the internal task_current_syscall() call.