Ah - a good approach - I thought the callback was supposed to supply data, but it seems that it's enough to just register the access. Then, potentially Inotify or truss or strace might produce the appropriate list of system calls as well.