properly set O_CLOEXEC in cgroups.c