protect pipe fd with O_CLOEXEC