cybersecurity · intermediate · ~15 min

Score a setuid program against the 5-item checklist

Mechanise an audit checklist.

Challenge

Given five boolean flags (1 = OK, 0 = fail), score the program. Each flag corresponds to one item:

  • f1 = environment scrubbed (clearenv called)
  • f2 = fds 0/1/2 confirmed open at start
  • f3 = uses geteuid for auth decisions, not getuid
  • f4 = uses openat + O_NOFOLLOW for file access
  • f5 = does not call system/popen

Implement int setuid_score(int f1, int f2, int f3, int f4, int f5) returning the count of items passing (0..5).

Why this matters

Auditing setuid programs is rote — 5 items. Mechanising the score makes you fast.

Input format

5 booleans.

Output format

Count.

Constraints

Sum 0/1 values.

Starter code

int setuid_score(int f1, int f2, int f3, int f4, int f5) { /* TODO */ (void)f1; (void)f2; (void)f3; (void)f4; (void)f5; return 0; }

Common mistakes

Treating any non-zero as 1 (we want strict 0/1).

Edge cases to handle

All zero. All one. Any combination.

Complexity

O(1).

Background lessons

Solve this exercise in the browser editor — compile and run against the test harness, no setup required.