execve is always needed, whitelist it by default