The attached patch:

1. Preserves complaints to standard error even under '-2'
2. Adds a '-N' ("null device") flag which modifies '-[012]' to
redirect /dev/null with appropriate access modes, rather than merely
closing fds
3. Documents #2

Rationale:  #1 above helps me debug otherwise quiet ``chpst -2
/oops/enoent'' typographical errors.  #2 guards against some programs'
naive assumptions about the availability and nature of fds 0, 1 and 2.

Implementation notes:  The '-N' flag redirects before chroot, and
respects the improved semantics of '-2' (that is, chpst can still
complain of exec failures).  Unmodified '-[012]' are now implemented
with close-on-exec rather than close().  Other than the possibility of
new complaints to stderr under '-2', the patch is behaviorally
backward compatible.

Let me know if you think this is wrong-headed.

-Mike