I have some scripts that run as hooks after dhcpcd events are generated. Bizarrely, every few days this script fails with WEXITSTATUS 2, something that doesn’t happen if I turn off sandboxing. Thing is, I have no idea how I would go about figuring out which system call failed so I don’t know which ReadWritePaths (for instance) I need to add.

Short of strace-ing the entire process tree for several days and then picking through it for failed system calls, is there any straightforward way of finding out what unexpected thing the script is trying to touch? (E.g., how do package maintainers determine the ReadWritePaths for something they didn’t author?) Is there any kind of debug mode or wrapper I can use that will log everything a process tree touches?