Implementation If systrace process dies, all monitored processes receive a SIGKILL from the kernel. Userland handles more complicated policies and notifications. native-open: filename match "$HOME/.opera/*" then permit Systrace consists of two parts: Intercept abstraction to /dev/systrace: Systrace application.