combining the ptrace approach for logging with mount namespaces, snapshotting or overlayfs would probably be more consistent approach if the program actually tries to use the files.

just stubbing out the system calls sounds like it'll quickly break down once the programs try to do something more complicated with the files.