One thing I forgot to mention is that by using hashes to identify executables, picosnitch can provide more reliable intrusion detection since different executables can appear to be located on the same path.

For example, it can successfully identify whether curl being run from inside a docker container is the same or different from curl being run on your system, even if they both appear to be located at /usr/bin/curl.

To improve performance, hashes are cached based on the device and inode of the executable, and watched with fanotify to trigger a rehash if the executable is modified.