travis + valgrind thinks we leak some tempfiles

These feel like false positives to me, but let's eliminate the lack of
CLOEXEC as a source of problems.