Fork a new process using clone()

Use clone() because it gives us the ability to create new namespaces
and potentially umount unneeded file system directories. Some (most?)
devices may not come with support for ns, hopefully this improves
in the future. Until then, we don't lose much, except keeping
CAP_SYS_ADMIN a little longer.

When supported, we create new namespaces:
  CLONE_NEWIPC
  CLONE_NEWNS
  CLONE_NEWPID
  CLONE_NEWUTS
Correct minor bug, only update new MAC on success