Don't use O_NOFOLLOW
    
    Switch to using a before/after lstat()/fstat() check instead of
    O_NOFOLLOW to ensure there aren't any shenanigans going on when we go to
    tweak permissions on an NSS database's individual files.  O_NOFOLLOW
    isn't as portable as we'd need.