Provos' systrace (2002)


A system-call interposer with argument observation mechanism

Easy for static observation

Dynamic observation was less fun

Had TOCTOU problems with some system calls due to the BSD syscall
interface

Designed for fine-grained control, but fails.