> That's overkill for most things since it relies on being able to patch running kernel code, which is also the definition of an RCE exploit. The idea of dtrac

> That's overkill for most things since it relies on being able to patch running kernel code, which is also the definition of an RCE exploit. The idea of dtrace is that you can do that, yes, but to that, you need to be authorized, and the things you can do are (supposed to be) limited to looking to see what’s happening in the system. You can read arguments, but can’t, for example, change the arguments of a system call or disable authorization checks on system calls.