What security software runs in user space? Even on the Linux side I struggle to name any except snort or any of the open source root kit scanners. How would y

What security software runs in user space? Even on the Linux side I struggle to name any except snort or any of the open source root kit scanners. How would you enforce security policies in user space?