Ptrace

Ptrace is a nice setup ( some people call dirty setup) on linux to debug running processes. This ptrace in sys/ptrace.h is used by strace and gdb. To trace a child process, the child process should call PTRACE_TRACEME. The kernel during each system call(or execution of each instruction) checks if the process is traced. If it is traced, it issues a SIGTRAP, the parent process if in wait() state, will get a signal. The parent issues a SIGSTOP to hold current state of child and can access the registers and memory of child using PEEKDATA and alter the values in register and memory using POKEDATA. Once the required job is done, parent will allow the child to run with a SIGCONT signal. Since one can access registers, the next instruction to be executed can be easily found using instruction pointer, this comes in handy when we need to set breakpoints while debugging. The entire code base can also be changed using ptrace.

PTRACE_ATTACH attaches a running process. It does some hack to become a temporary parent of the process(though PPID of the process points to the original parent). This helps us to run strace on any process with just the pid.
A comprehensive tutorial on ptrace is availabe at
http://www.linuxjournal.com/article/6100?page=0,0
http://www.linuxjournal.com/article/6210?page=0,0

Ptrace will cause huge performance degradation as it causes the child to make a lot of context switching(due to SIGSTOP signal)
Since Ubuntu 10.10, some restrictions are put on ptrace_attach where a non privileged user cant attach a process even if it is  running with the same uid as his. The file /etc/sysctl.d/10-ptrace.conf(the file  is self explanatory) has to edited appropriately if PTRACE_ATTACH is to be executed by non privileged users.