native: add "open" syscall wrapper
FIXUP:  guard native system calls