> "It rewrites the syscalls to make them succeed" Imagine some applications expect the syscall to actually fail (ie. some odd way to test permissions). I fail

> "It rewrites the syscalls to make them succeed" Imagine some applications expect the syscall to actually fail (ie. some odd way to test permissions). I fail to grasp how this is a strength. Pulling the rug from under applications is dangerous. You're in a direct battle with internal implementation specifics - you don't want to get into that as an abstraction layer. You don't want to tailor various hacks for specific applications.