Check fanotify

[probonopd]

Check https://github.com/amir73il/fsnotify-utils/wiki/Super-block-root-watch

Super block root watch is designed to solve the scalability issues with inotify recursive watches.

The fanotify super block watch patch set is meant to fill this gap in functionality and add the functionality of a root watch. It was merged to kernel v5.1-rc1. Currently fanotify needs root rights (CAP_ADMIN privileges)

As far as I understand it, this feature has been introduced to the kernel for on-access virus scanners, but possibly it would be interesting for AppImageLauncher, too.

[TheAssassin]

The wiki page isn't too helpful on what this system provides or doesn't provide. I don't see any way to intercept calls, which is kind of important. Any further references? How did you find this? It doesn't seem to be used widely.

[probonopd]

Not sure if it can intercept, but if it's supposed to be for on-access virus scanners, I guess you could use whatever those on-access virus scanners use. I have not investigated it all the way yet.