do not leak /dev/urandom file descriptors