Is this syscall on the allow-list?

Challenge

Given a sorted allow-list of syscall numbers and a candidate number, implement int syscall_allowed(int sys, const int *allow, int n_allow).

Return 1 if sys is in the allow-list (use binary search since it's sorted), 0 otherwise.

Why this matters

seccomp filters are how Chrome, OpenSSH and Docker shrink attack surface. The core operation is a simple set-membership test.

Input format

Syscall number + sorted array.

Output format

0/1.

Constraints

Use binary search (O(log n)).

Starter code

int syscall_allowed(int sys, const int *allow, int n_allow) { /* TODO */ (void)sys; (void)allow; (void)n_allow; return 0; }

Common mistakes

Linear search — works but doesn't demonstrate the right pattern.

Edge cases to handle

Empty allow-list (deny all). Negative syscall.

Complexity

O(log n).

Background lessons

• seccomp-BPF — allow-list system calls