Mark file descriptors with O_CLOEXEC