My thought exactly. This should also take care of processes crashing (and thus having their fds closed).
* open device on app start if privileges satisfied (so not all apps can)
* ioctl to lock/unlock
* close automatically unlocks
Maybe the wakelock name should just be the app name and PID?