Is this syscall on the allow-list?

Challenge

Decide whether a syscall is permitted by checking it against a sorted allowlist — the set-membership test at the heart of a seccomp filter.

Task

Implement int syscall_allowed(int sys, const int *allow, int n_allow) that returns 1 if sys appears in the allowlist and 0 otherwise. The allowlist is sorted ascending, so use binary search.

Input

• sys: the candidate syscall number.
• allow: a sorted (ascending) array of allowed syscall numbers the grader provides; may be NULL.
• n_allow: the number of entries in allow.

Output

Returns 1 if sys is in the allowlist, 0 otherwise.

Example

allow = {0, 1, 2, 3, 11, 60, 231}
syscall_allowed(0,   allow, 7)   ->   1   (read)
syscall_allowed(11,  allow, 7)   ->   1   (mmap)
syscall_allowed(59,  allow, 7)   ->   0   (execve — not listed)
syscall_allowed(-1,  allow, 7)   ->   0
syscall_allowed(0,   NULL, 0)    ->   0   (empty list denies all)

Edge cases

• Empty allowlist (n_allow <= 0 or allow == NULL): deny everything, return 0.
• Negative or unlisted syscall: return 0.

Rules

• Use binary search (O(log n)), exploiting the sorted order.

Why this matters

seccomp filters are how Chrome, OpenSSH and Docker shrink attack surface. The core operation is a simple set-membership test.

Input format

A syscall number sys, a sorted ascending array allow (may be NULL), and its length n_allow.

Output format

1 if sys is in the allowlist; otherwise 0.

Constraints

Use binary search (O(log n)); empty list denies all.

Starter code

int syscall_allowed(int sys, const int *allow, int n_allow) { /* TODO */ (void)sys; (void)allow; (void)n_allow; return 0; }

Common mistakes

Linear search — works but doesn't demonstrate the right pattern.

Edge cases to handle

Empty allow-list (deny all). Negative syscall.

Complexity

O(log n).

Background lessons

• seccomp-BPF — allow-list the system calls a process may make