vc_exec: fork vc (privsep)