about a syscall filter, the range of exercises is large and some have a fair use of some syscalls. They could maintain a allow-list of syscalls but this is extra work they might not want to do given the actual risks.
about `MemoryDenyWriteExecute`, `mprotect` is also reachable via an offset so we can just get a write-only page, then make it exec-only.
author here, I have checked this, but the static analysis is good enough that they use run checks on the AST clang parses. The content is thus parsed and `JOIN(exe,cve)` still ends up as a banned symbol in the end.
about a syscall filter, the range of exercises is large and some have a fair use of some syscalls. They could maintain a allow-list of syscalls but this is extra work they might not want to do given the actual risks.
about `MemoryDenyWriteExecute`, `mprotect` is also reachable via an offset so we can just get a write-only page, then make it exec-only.