Systrace

A matching policy issues a decision:
deny - including error number:
for example: ENOENT or EPERM
permit- action is allowed
for execve, may specify policy inherit.

If no policy entry matches, systrace asks the user.
In automatic enforcement mode, asking results in an automatic denial of system call.
In automatic policy generation mode, new policy is generated matching arguments precisely.