subprocess's syscalls are not limited in fssb so that escape may happen

[Cossack9989]

#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>

int main(){
	pid_t pid;
	pid = fork();
	printf("pid: %d\n",pid);
	if(pid==0){
		puts("hello?");
		open("fuck.txt", O_CREAT, 0666);
	}
	return 0;
}

As we can see, we create an escaped file by using subprocess to operate files.