[sherincall]

You can LD_PRELOAD an .so that overrides `open` and family of functions, and drop opens based on a whitelist/blacklist.