SECRETMEM_FLAGS_MASK
BUILD_BUG_ON(SECRETMEM_FLAGS_MASK & O_CLOEXEC);
if (flags & ~(SECRETMEM_FLAGS_MASK | O_CLOEXEC))