CLOEXEC must be called even when NO_FORK.