You would have to be able to overwrite a syscall in userspace (which would be a massive security hole) or have some kinda kernel driver (but you said disk encryption doesn't work for some odd reason, otherwise that's your solution right there).
I guess, as you stated, you might be able to write a fuse application to do it, but I don't see the benefit over just an encrypted disk.
Comments
You would have to be able to overwrite a syscall in userspace (which would be a massive security hole) or have some kinda kernel driver (but you said disk encryption doesn't work for some odd reason, otherwise that's your solution right there).
I guess, as you stated, you might be able to write a fuse application to do it, but I don't see the benefit over just an encrypted disk.
It would be possibe'le, but its very easy to shoot yourself in the foot with that.