While it might not give you enough control (yet?) I have written a program, which at least partially fulfills your needs,using the linux-kernel's fanotify and unshare to monitor only files modified (or read) by a specific process and its children.Compared to strace, it is quite fast (;
It can be found onhttps://github.com/tycho-kirchner/shournal
Example on the shell:
$ shournal -e sh -c 'echo hi > foo1; echo hi2 > foo2'$ shournal -q --history 1 # ... Written file(s): /tmp/foo1 (3 bytes) Hash: 15349503233279147316 /tmp/foo2 (4 bytes) Hash: 2770363686119514911