use white list for syscall check