Yes, the file access part of this product is exactly what I wrote too. They even made it with just the same codebase, inside the bundle "HandsOff.kext" is where all the action is. It's commendable that these guys have made it & kept it going and have it running as a product. It is so much more difficult than it initially appears. One of the first things that you come up against is you find out that at the kernel level, there are thousands of open()'s occurring system wide a second. Managing that in linked lists in the kernel without creating a speed or memory hit is the initial challenge. Then the other thing you come up against, which is a much greater challenge, is avoiding deadlocks by blocking open()'s to the wrong process.

However, if a technical user is using the product, it makes security 100% solid. You can literally intentionally download and run any virus, with full confidence that you can easily stop it from doing anything you dont want it to. Since a dialog box is created before it can read or write to any file, there is literally nothing it can do without your permission.

It's also useful for monitoring what an installer or app is doing to your filesystem, exactly what files it is touching as it goes along, and also how to thoroughly uninstall it if you want to.

I have been meaning to make a cut down version just for the filesystem monitoring and as an uninstaller that works 100%. You can even make an uninstaller that not only uninstalls all files that were created alongside the file you choose, but also any files that were created by any of those files (by logging the paths of the open()'s with O_CREATE by any of those files)