core: Add O_CLOEXEC to open()