I think this approach would still fail if the program is not behaving as expected by the user. For instance, I didn't know until reading this article that 'les

I think this approach would still fail if the program is not behaving as expected by the user. For instance, I didn't know until reading this article that 'less' on ubuntu went through lesspipe, but the people maintaining the tools know that. If for some legitimate use case lesspipe needed access to the internet, the local database could allow that behavior without any warning, but as a user I would still be dumbfounded that a 'less' command ends up generating network connections.