I wrote an eBPF security monitoring tool for an endpoint protection solution that is surprisingly similar to your proposed solution of walking the dentry tree f

I wrote an eBPF security monitoring tool for an endpoint protection solution that is surprisingly similar to your proposed solution of walking the dentry tree for obtaining the command path. It basically takes a block of memory, and splits it in a static array of arrays, and then walks the dentry tree, copying each portion of the path into it. It then follows and decodes the mount path in a similar way, and it's fully recomposed in user space into a single path. I could have done the mount path in userspace too probably by just passing some identifier.