fix grant before exec

init didn't initialize IFC in the sandbox compartment

check IFC at grant/attachObject