gcc: sandbox within libexec