You can build an ordered tree of all the programs launched by a program, recursively, using strace. You can do the same for observing files opened. It's an amazing tool when you need to observe some software from the outside; in many ways it'll give you much better understanding of a program than even reading it's source code.
I'm particularly intrigued about what I can do with system call tampering. I like the example of being able to make unlink() be a no-op, giving you easy access to a temporary file which is normally automatically cleaned up.
I kind of think of the interactions with the OS as the "effects" of the application like the IO Monad.
It's like a protocol too, function application in a certain order causes the effects of the software. The syscalls is a stream.
There is also a inner protocol between the buffers of binary protocols inside the syscalls such as a network buffer.