Intercept syscalls of a child process using ptrace

tracer.c

#include <stdio.h>
#include <sys/ptrace.h>
#include <sys/reg.h>
#include <sys/wait.h>
#include <unistd.h>

int main() {
  int status;

  pid_t child_pid = fork();
  if (child_pid == 0) {
    ptrace(PTRACE_TRACEME, 0, NULL, NULL);
    execl("/bin/ls", "ls", NULL);
  } else {
    for (;;) {
      waitpid(child_pid, &status, WCONTINUED);
      if (WIFEXITED(status))
        break;

      long syscall_id = ptrace(PTRACE_PEEKUSER, child_pid, 8 * ORIG_RAX, NULL);
      printf("Syscall %ld\n", syscall_id);
      ptrace(PTRACE_SYSCALL, child_pid, NULL, NULL);
    }
  }
  return 0;
}