move cgroup hack up to end of fork, before extmon execl()