fork into sandbox syscall