suboptimal by closing all possible file descriptors rather than just
the open ones in the child process before exec().

It now closes only the open fds when it is possible to safely determine what
those are.