build system call whitelist in the parent