Don't close descriptors for fork-without-exec
    
    When we fork to call kuserok() with target user privs, don't close all
    of our open file descriptors, since library APIs that are using them
    (like nsswitch) won't know that we've done that to any that they have
    open.  Based on a report from Roshni Pattath.