syscall whitelisting via argument and file