[nrdxp]

You would have to be able to overwrite a syscall in userspace (which would be a massive security hole) or have some kinda kernel driver (but you said disk encryption doesn't work for some odd reason, otherwise that's your solution right there).

I guess, as you stated, you might be able to write a fuse application to do it, but I don't see the benefit over just an encrypted disk.

[stop50]

It would be possibe'le, but its very easy to shoot yourself in the foot with that.