ujail: add O_CLOEXEC flag to open() call