title: Is all file operation must be done after syscall open()?
body: <p>I am trying to implement a sandbox for all file operation(including file, directory, links etc.) base on Linux syscall. Just wondering which syscall I should monitor using ptrace. </p>
  
  <p>It seems that we must open() a file first in order to read/write/execute. Is that mean we only need to have our eyes on open()? Is there any other way to replace open()?</p>