work around Linux systems that don't provide FD_CLOEXEC or SOCK_NONBLOCK