LD_PRELOAD and hooking the libc syscall wrappers doesn't seem very reliable.

It won't work on static binaries, it depends on the user not clearing the environment and there are also many programs that use the syscall directly, bypassing the hooks. From playing with file system hooks I remember programs written in Go and sqlite used to do this.