Spread around some O_CLOEXEC love.

Also remove some unnecessary SELinux logic when creating image files
for loop devices.

Test: builds, boots, common operations work
Bug: 34903607
Change-Id: I68dfa022ecc39f56c175e786694e0de35b954ca0
diff --git a/main.cpp b/main.cpp
index c106af9..4657377 100644
--- a/main.cpp
+++ b/main.cpp
@@ -192,7 +192,7 @@
         if (de->d_type != DT_DIR && lvl > 0)
             continue;
 
-        fd = openat(dfd, de->d_name, O_RDONLY | O_DIRECTORY);
+        fd = openat(dfd, de->d_name, O_RDONLY | O_DIRECTORY | O_CLOEXEC);
         if(fd < 0)
             continue;