cybersecurity · intermediate · ~15 min · safe pentest lab
Model an allowlist filter.
Model the core of a seccomp-BPF filter: check whether a syscall number is on the allowlist that narrows a process to a known-good set.
Implement int syscall_allowed(const int *allow, int n, int nr) that returns 1 if nr appears in the allow array, and 0 otherwise. (The list is small and unsorted, so a linear search is fine.)
allow: an array of allowed syscall numbers the grader provides.n: the number of entries in allow.nr: the candidate syscall number.Returns 1 if nr is in the allowlist, 0 otherwise.
allow = {0, 1, 2, 60}
syscall_allowed(allow, 4, 0) -> 1 (read)
syscall_allowed(allow, 4, 59) -> 0 (execve — not listed)
n == 0) denies everything.An allowlist array allow, its length n, and a candidate syscall number nr.
1 if nr is in allow; otherwise 0.
Linear search the allowlist.
int syscall_allowed(const int *allow, int n, int nr) {
/* TODO */
return 0;
}
Solve this exercise in the browser editor — compile and run against the test harness, no setup required.