posix_spawn(): close the pipe read fd in the parent.

* also enable close-on-exec for the eventually dupped pipe write fd in the child.

src/system/libroot/posix/spawn.cpp

@@ -387,6 +387,7 @@ process_file_actions(const posix_spawn_file_actions_t *_actions, int *errfd)
 			if (newfd == -1)
 				return errno;
 			close(action->fd);
+			fcntl(newfd, F_SETFD, FD_CLOEXEC);
 			*errfd = newfd;
 		}
 
@@ -443,6 +444,7 @@ do_posix_spawn(pid_t *_pid, const char *path,
 		read(fds[0], &err, sizeof(err));
 		if (err != 0)
 			waitpid(pid, NULL, WNOHANG);
+		close(fds[0]);
 		return err;
 	}