add syscall guard functions, wrap read/write