Page "Systrace" Paragraph 4

* Confines untrusted binary applications: An application is allowed to make only those system calls specified as permitted in the policy.

If the application attempts to execute a system call that is not explicitly permitted an alarm gets raised.