1. A non-transitory, machine-readable medium encoded with logic that, when executed by a processor, causes the processor to perform a method comprising: monitoring system calls to a kernel of a mobile computing device; intercepting a particular system call of the monitored system calls, the particular system call relating to input/output (I/O) functionality of the mobile computing device; identifying a data loss prevention (DLP) policy applicable to the particular system call; and performing an action on the particular system call based at least in part on the DLP policy.