guard more system calls, invert syscall guard