cybersecurity · beginner · ~15 min · safe pentest lab

Safer alternative to system()?

Prefer exec-family over the shell.

Challenge

Classify a process-launch function by whether it avoids the shell. The exec family takes an explicit argv and never invokes a shell, so there is no command-injection surface.

Task

Implement int is_safer_exec(const char *fn) that returns 1 for the shell-free exec functions and 0 for the shell-invoking ones.

  • Return 1 for "execv" and "execve".
  • Return 0 for "system" and "popen".

Input

  • fn: a NUL-terminated function name the grader passes.

Output

Returns int: 1 if fn is a shell-free exec function, else 0.

Example

is_safer_exec("execv")    ->   1
is_safer_exec("system")   ->   0
is_safer_exec("popen")    ->   0

Edge cases

  • Only the exact exec names return 1.

Rules

  • Exact name comparison.

Input format

A NUL-terminated function name fn.

Output format

An int: 1 for execv/execve, else 0.

Constraints

Exact match; execv/execve -> 1, system/popen -> 0.

Starter code

#include <string.h>

int is_safer_exec(const char *fn) {
    /* TODO */
    return 0;
}

Solve this exercise in the browser editor — compile and run against the test harness, no setup required.