Yeah, that would work too in most cases - except if there's no VFS connection
between tracer and tracee. (as it might be in the case of say chroot environments,
etc.)
I think it's better to have kernel solutions that dont modify the VFS beyond the
trace.data session info. A task could thus generate a user-space event without
having to negotiate with the tracer.
Thanks,
Ingo
--