PathArmor will forward most system calls directly to their vanilla implementation, imposing little to zero extra over­head.
we consider a total of seven system call fam­ilies as dangerous, and start verification whenever these are encountered: mprotect and the mmap family (which can be used to disable DEP/Wfix), and the exec family (which can be used to start a malicious command) are obvious choices and have been considered in prior work in the area [19].