Add ability to spawn a sandboxed child process on Linux

[conradev]

Implement it in a similar way to how AVNE does it.