My previous patch 5950ba91 ("lib/namespace: don't leak fd in error case")
was a step in the wrong direction. Instead of closing the opened file
descriptor in error case only, follow a better approach here and close
the fd as soon as it is not used anymore. This way the inelegant goto
statements can be dropped, and the fd leak in non-error case is fixed as
well.

Fixes: 5950ba91 ("lib/namespace: don't leak fd in error case")
Signed-off-by: Phil Sutter <phil@nwl.cc>