[amelius]

Not necessarily. You can use the ptrace() system call to trace a process and store what it reads/writes into a journal, etc.

https://man7.org/linux/man-pages/man2/ptrace.2.html