correctly set cloexec. oops