cybersecurity · intermediate · ~15 min · safe pentest lab

Is the syscall on the allowlist?

Model an allowlist filter.

Challenge

Model the core of a seccomp-BPF filter: check whether a syscall number is on the allowlist that narrows a process to a known-good set.

Task

Implement int syscall_allowed(const int *allow, int n, int nr) that returns 1 if nr appears in the allow array, and 0 otherwise. (The list is small and unsorted, so a linear search is fine.)

Input

  • allow: an array of allowed syscall numbers the grader provides.
  • n: the number of entries in allow.
  • nr: the candidate syscall number.

Output

Returns 1 if nr is in the allowlist, 0 otherwise.

Example

allow = {0, 1, 2, 60}
syscall_allowed(allow, 4, 0)    ->   1   (read)
syscall_allowed(allow, 4, 59)   ->   0   (execve — not listed)

Edge cases

  • A syscall not in the list returns 0.
  • An empty list (n == 0) denies everything.

Input format

An allowlist array allow, its length n, and a candidate syscall number nr.

Output format

1 if nr is in allow; otherwise 0.

Constraints

Linear search the allowlist.

Starter code

int syscall_allowed(const int *allow, int n, int nr) {
    /* TODO */
    return 0;
}

Solve this exercise in the browser editor — compile and run against the test harness, no setup required.