Say I've got a program
mysterion the execution of which will probably modify some files. In order to figure out whether this is harmful or not I'd like to run it in such a way that I can at the very least know which files got modified how, or maybe even somehow hook another program to it that decides whether to accept or deny those change before they even happen. Can that be achieved somehow less tedious than a step-by-step debugging?
Sure enough for the "determine changes" part I could snapshot the entire filesystem and
diff it afterwards, but that would probably be like braking a nut with a sledgehammer...