Find syscalls whitelisted by seccomp

Question

So I stumbled across a program in C that uses seccomp to filter out a few syscalls. Is there anyway, other than bruteforcing, to find out the syscalls that are actually allowed.

Thanks in advance

Answer 1

You can refer to Kafel, write a policy and disassemble the generated eBPF code with its dump_policy_bpf tool.

Answer 2

If you can compile the C program, you can call seccomp_export_pfc function.