Comment by PhilipRoman

The shell can be disabled, leaving just fork+exec