fixes
use O_CLOEXEC where possible