Default-deny action

Challenge

Encode a seccomp filter's default-deny policy: allow what is explicitly permitted, kill everything else — the safe sandbox posture.

Task

Implement int seccomp_action(int allowed) that returns 0 (ALLOW) when allowed is true, and -1 (KILL) otherwise.

Input

• allowed: 1 if the syscall is on the allowlist, 0 otherwise.

Output

Returns 0 (ALLOW) when allowed is true, -1 (KILL) when it is false.

Example

seccomp_action(1)   ->   0    (ALLOW)
seccomp_action(0)   ->   -1   (KILL)

Edge cases

• Anything not explicitly allowed is killed.

Input format

A flag allowed (1 if the syscall is permitted, 0 otherwise).

Output format

0 (ALLOW) if allowed is true; -1 (KILL) otherwise.

Constraints

Default-deny: allow only when allowed is true.

Starter code

int seccomp_action(int allowed) {
    /* TODO */
    return -1;
}