Decide whether an fd-target string is suspicious

Challenge

Flag a process's open-file descriptor as suspicious based on where its /proc/PID/fd/ symlink points — a basic forensic heuristic.

Those symlinks resolve to strings such as /usr/bin/cat (a regular file), socket:[12345], pipe:[12345], anon_inode:[eventfd], /etc/shadow (a sensitive system file), or /proc/PID/mem (another process's memory).

Task

Implement int classify_fd_target(const char *target) that returns:

• 1 if target is exactly /etc/shadow, or starts with /proc/ but is not under /proc/self/ (inspecting another process is suspicious);
• 0 for everything else.

Input

• target: a fixed symlink-target string the grader provides (NUL-terminated; may be empty or NULL).

Output

Returns 1 if the target is suspicious, 0 otherwise.

Example

classify_fd_target("/usr/bin/cat")         ->   0
classify_fd_target("/etc/shadow")          ->   1
classify_fd_target("/proc/1234/mem")       ->   1   (another process)
classify_fd_target("/proc/self/status")    ->   0   (self-inspection is fine)
classify_fd_target("socket:[12345]")       ->   0
classify_fd_target("")                     ->   0
classify_fd_target(NULL)                   ->   0

Edge cases

• /proc/self/... is normal self-introspection: return 0.
• Empty string or NULL: return 0.

Why this matters

/proc/PID/fd/ symlinks point at whatever the process has open — files, sockets, pipes, eventfds. A defender's tool flags any fd that resolves to a suspicious path.

Input format

A fixed symlink-target string (NUL-terminated; may be empty or NULL).

Output format

1 if target is /etc/shadow or /proc/ but not /proc/self/; otherwise 0.

Constraints

String prefix logic; NULL-safe.

Starter code

int classify_fd_target(const char *target) { /* TODO */ (void)target; return 0; }

Common mistakes

Flagging /proc/self/* (that's normal — process inspecting itself).

Edge cases to handle

Empty string; exactly '/proc' (no trailing slash).

Complexity

O(strlen).

Background lessons

• /proc forensics — a cookbook

Up next

• Parse a /proc/net/tcp line and detect a public LISTEN