Systrace

Policy files contain binary name and emulation.
No collision possible.
Policy: /bin/ls, Emulation: native

Policy files get rewritten during interactive generation of policy.
Policy can be refined via text prompt or UI window.

Policy is applied to translated system call arguments.

native-open(5): filename: /var/run/ld.so.hints, oflags: ron

Policy for each system call is parsed into a logic tree.
Simple recursion checks against the translated arguments.